diff --git a/data/2023/CVE-2023-39970.json b/data/2023/CVE-2023-39970.json index 85832500f9..0ee189bc51 100644 --- a/data/2023/CVE-2023-39970.json +++ b/data/2023/CVE-2023-39970.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://extensions.joomla.org/extension/acymailing-starter/","defaultStatus":"unaffected","packageName":"com_acymailing","product":"AcyMailing component for Joomla","vendor":"acymailing.com","versions":[{"status":"affected","version":"6.7.0-8.5.0"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acyba:acymailing_starter:*:*:*:*:*:joomla\\!:*:*","matchCriteriaId":"CE33CFC3-0BCF-443E-8991-D4C6F42E1AD5","versionEndIncluding":"8.5.0","versionStartIncluding":"6.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution."},{"lang":"es","value":"Vulnerabilidad de carga no restringida de archivos de tipo peligroso en el componente AcyMailing para Joomla. Permite la ejecución remota de código."}],"id":"CVE-2023-39970","lastModified":"2026-06-17T06:13:03.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-39970","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-10-07T19:49:39.743303Z","version":"2.0.3"}}]},"published":"2023-08-17T21:15:09.243","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@joomla.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-434"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://extensions.joomla.org/extension/acymailing-starter/","defaultStatus":"unaffected","packageName":"com_acymailing","product":"AcyMailing component for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"6.7.0-8.5.0"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acyba:acymailing_starter:*:*:*:*:*:joomla\\!:*:*","matchCriteriaId":"CE33CFC3-0BCF-443E-8991-D4C6F42E1AD5","versionEndIncluding":"8.5.0","versionStartIncluding":"6.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution."},{"lang":"es","value":"Vulnerabilidad de carga no restringida de archivos de tipo peligroso en el componente AcyMailing para Joomla. Permite la ejecución remota de código."}],"id":"CVE-2023-39970","lastModified":"2026-11-12T19:16:44.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-39970","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-10-07T19:49:39.743303Z","version":"2.0.3"}}]},"published":"2023-08-17T21:15:09.243","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@joomla.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-434"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2023/CVE-2023-39971.json b/data/2023/CVE-2023-39971.json index 07802ddf0c..45353a6618 100644 --- a/data/2023/CVE-2023-39971.json +++ b/data/2023/CVE-2023-39971.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://extensions.joomla.org/extension/acymailing-starter/","defaultStatus":"unaffected","packageName":"com_acymailing","product":"AcyMailing Enterprise component for Joomla","vendor":"acymailing.com","versions":[{"status":"affected","version":"6.7.0-8.6.3"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"8B4D61C7-1AAD-43DA-890F-EC999F056C6E","versionEndExcluding":"8.7.0","versionStartIncluding":"6.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3."},{"lang":"es","value":"La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web en el componente AcyMailing Enterprise para Joomla permite Cross-Site Scripting (XSS). Este problema afecta al componente AcyMailing Enterprise para Joomla: 6.7.0-8.6.3."}],"id":"CVE-2023-39971","lastModified":"2026-06-17T06:13:03.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-39971","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-15T17:09:01.484633Z","version":"2.0.3"}}]},"published":"2023-08-17T21:15:09.357","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"security@joomla.org","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@joomla.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://extensions.joomla.org/extension/acymailing-starter/","defaultStatus":"unaffected","packageName":"com_acymailing","product":"AcyMailing Enterprise component for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"6.7.0-8.6.3"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"8B4D61C7-1AAD-43DA-890F-EC999F056C6E","versionEndExcluding":"8.7.0","versionStartIncluding":"6.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation vulnerability in AcyMailing Enterprise component for Joomla allows XSS. This issue affects AcyMailing Enterprise component for Joomla: 6.7.0-8.6.3."},{"lang":"es","value":"La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web en el componente AcyMailing Enterprise para Joomla permite Cross-Site Scripting (XSS). Este problema afecta al componente AcyMailing Enterprise para Joomla: 6.7.0-8.6.3."}],"id":"CVE-2023-39971","lastModified":"2026-11-12T18:17:10.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-39971","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-15T17:09:01.484633Z","version":"2.0.3"}}]},"published":"2023-08-17T21:15:09.357","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"security@joomla.org","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@joomla.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-79"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2023/CVE-2023-39972.json b/data/2023/CVE-2023-39972.json index 0fbb109b7f..62fdce06ba 100644 --- a/data/2023/CVE-2023-39972.json +++ b/data/2023/CVE-2023-39972.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://extensions.joomla.org/extension/acymailing-starter/","defaultStatus":"unaffected","packageName":"com_acymailing","product":"AcyMailing Enterprise component for Joomla","vendor":"acymailing.com","versions":[{"status":"affected","version":"6.7.0-8.6.3"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"8B4D61C7-1AAD-43DA-890F-EC999F056C6E","versionEndExcluding":"8.7.0","versionStartIncluding":"6.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists."},{"lang":"es","value":"Vulnerabilidad de control de acceso inadecuado en el componente AcyMailing Enterprise para Joomla. Permite a usuarios no autorizados crear nuevas listas de correo."}],"id":"CVE-2023-39972","lastModified":"2026-06-17T06:13:03.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-39972","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-07T19:48:33.885440Z","version":"2.0.3"}}]},"published":"2023-08-17T21:15:09.437","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"security@joomla.org","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@joomla.org","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://extensions.joomla.org/extension/acymailing-starter/","defaultStatus":"unaffected","packageName":"com_acymailing","product":"AcyMailing Enterprise component for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"6.7.0-8.6.3"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"8B4D61C7-1AAD-43DA-890F-EC999F056C6E","versionEndExcluding":"8.7.0","versionStartIncluding":"6.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists."},{"lang":"es","value":"Vulnerabilidad de control de acceso inadecuado en el componente AcyMailing Enterprise para Joomla. Permite a usuarios no autorizados crear nuevas listas de correo."}],"id":"CVE-2023-39972","lastModified":"2026-11-12T18:17:11.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-39972","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-07T19:48:33.885440Z","version":"2.0.3"}}]},"published":"2023-08-17T21:15:09.437","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"security@joomla.org","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@joomla.org","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2023/CVE-2023-39973.json b/data/2023/CVE-2023-39973.json index 71785aeb27..c86a92d41a 100644 --- a/data/2023/CVE-2023-39973.json +++ b/data/2023/CVE-2023-39973.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://extensions.joomla.org/extension/acymailing-starter/","defaultStatus":"unaffected","packageName":"com_acymailing","product":"AcyMailing Enterprise component for Joomla","vendor":"acymailing.com","versions":[{"status":"affected","version":"6.7.0-8.6.3"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"8B4D61C7-1AAD-43DA-890F-EC999F056C6E","versionEndExcluding":"8.7.0","versionStartIncluding":"6.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns."},{"lang":"es","value":"Vulnerabilidad de control de acceso inadecuado en el componente AcyMailing Enterprise para Joomla. Permite la eliminación no autorizada de archivos adjuntos de las campañas."}],"id":"CVE-2023-39973","lastModified":"2026-06-17T06:13:04.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-39973","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-07T19:49:07.081674Z","version":"2.0.3"}}]},"published":"2023-08-17T21:15:09.503","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"security@joomla.org","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@joomla.org","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://extensions.joomla.org/extension/acymailing-starter/","defaultStatus":"unaffected","packageName":"com_acymailing","product":"AcyMailing Enterprise component for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"6.7.0-8.6.3"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"8B4D61C7-1AAD-43DA-890F-EC999F056C6E","versionEndExcluding":"8.7.0","versionStartIncluding":"6.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns."},{"lang":"es","value":"Vulnerabilidad de control de acceso inadecuado en el componente AcyMailing Enterprise para Joomla. Permite la eliminación no autorizada de archivos adjuntos de las campañas."}],"id":"CVE-2023-39973","lastModified":"2026-11-12T18:17:11.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-39973","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-07T19:49:07.081674Z","version":"2.0.3"}}]},"published":"2023-08-17T21:15:09.503","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"security@joomla.org","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@joomla.org","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2023/CVE-2023-39974.json b/data/2023/CVE-2023-39974.json index b5d424ac20..a26dba0b65 100644 --- a/data/2023/CVE-2023-39974.json +++ b/data/2023/CVE-2023-39974.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://extensions.joomla.org/extension/acymailing-starter/","defaultStatus":"unaffected","packageName":"com_acymailing","product":"AcyMailing Enterprise component for Joomla","vendor":"acymailing.com","versions":[{"status":"affected","version":"6.7.0-8.6.3"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"8B4D61C7-1AAD-43DA-890F-EC999F056C6E","versionEndExcluding":"8.7.0","versionStartIncluding":"6.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list."},{"lang":"es","value":"Vulnerabilidad de exposición de información sensible en el componente AcyMailing Enterprise para Joomla. Permite a actores no autorizados obtener el número de suscriptores de una lista específica."}],"id":"CVE-2023-39974","lastModified":"2026-06-17T06:13:04.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-39974","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-07T19:47:55.762491Z","version":"2.0.3"}}]},"published":"2023-08-17T21:15:09.587","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"security@joomla.org","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@joomla.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-668"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://extensions.joomla.org/extension/acymailing-starter/","defaultStatus":"unaffected","packageName":"com_acymailing","product":"AcyMailing Enterprise component for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"6.7.0-8.6.3"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"8B4D61C7-1AAD-43DA-890F-EC999F056C6E","versionEndExcluding":"8.7.0","versionStartIncluding":"6.7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list."},{"lang":"es","value":"Vulnerabilidad de exposición de información sensible en el componente AcyMailing Enterprise para Joomla. Permite a actores no autorizados obtener el número de suscriptores de una lista específica."}],"id":"CVE-2023-39974","lastModified":"2026-11-12T19:16:44.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-39974","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-07T19:47:55.762491Z","version":"2.0.3"}}]},"published":"2023-08-17T21:15:09.587","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"security@joomla.org","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://extensions.joomla.org/extension/acymailing-starter/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://www.acymailing.com/acymailing-release-security-%F0%9F%94%90-news-updates/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@joomla.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-668"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2024/CVE-2024-21954.json b/data/2024/CVE-2024-21954.json new file mode 100644 index 0000000000..2a26ba4d4b --- /dev/null +++ b/data/2024/CVE-2024-21954.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.H"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.D"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Cache (ATC), potentially resulting in denial of service."}],"id":"CVE-2024-21954","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T19:16:44.843","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3052.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2024/CVE-2024-21963.json b/data/2024/CVE-2024-21963.json new file mode 100644 index 0000000000..fa224aec8b --- /dev/null +++ b/data/2024/CVE-2024-21963.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0k"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000HX Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"FireRangeFL1PI 1.0.0.0c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixHaloPI-FP11_1.0.0.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 9000 Series","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6 1.0.0.1b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Z2 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6 1.0.0.Ed"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.Bf"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7f"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1PI 1.0.0.3j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.2.b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6 1.0.0.1m"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 2000 Mobile Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Z1 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"},{"status":"unaffected","version":"ComboAM5 1.0.0.c"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"},{"status":"unaffected","version":"ComboAM5 1.0.0.c"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 7000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.5"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 8000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPhoenixPI-FP7r2_1.0.0.3"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 5000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbAM4PI 1.0.0.9"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000A Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedV2KAPI-FP6 1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP6_1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1.0.1.1"}]},{"defaultStatus":"affected","product":"AMD Ryzen Embedded V3000 EDKII Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) pages and potentially cause a host crash leading to loss of availability."}],"id":"CVE-2024-21963","lastModified":"2026-11-12T20:18:09.523","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:09.523","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3060.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/10/21"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-524.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2024/CVE-2024-36309.json b/data/2024/CVE-2024-36309.json index 2e710b8292..7fe790448b 100644 --- a/data/2024/CVE-2024-36309.json +++ b/data/2024/CVE-2024-36309.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI 1.0.0.G"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.H"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Rome-1.0.0.P"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Naples-1.0.0.S"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.1.0.3h"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI 1.0.0.5"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI300A Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MI300A 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.3.0.1a"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6_1.0.0.Ec"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.Bh"}]},{"defaultStatus":"affected","product":"AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1 PI-1.0.0.3m"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.H"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 3000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"CastlePeakPI-SP3r3_1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.0.0.1l"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.1.0.3h"},{"status":"unaffected","version":"ComboAM5PI_1.2.0.3k"},{"status":"unaffected","version":"ComboAM5PI 1.3.0.1b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.2.0.3k"},{"status":"unaffected","version":"ComboAM5PI 1.3.0.1a"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4 1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.Bh"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixHaloPI-FP11_1.0.0.1"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000HX Series Mobile Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"FireRangeFL1PI 1.0.0.0f"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"SnowyOwl_SP4_SP4r2.1.1.0.H"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbRomePI-SP3 1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 v9 1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors - Genoa","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors - Bergamo","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 5000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbAM4PI 1008"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 7000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 8000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPhoenixPI-FP7r2_1.0.0.2"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 9000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R1000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP5 1211"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedR2KPI-FP5 1006"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP5 1211"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP6_1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1012"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled device as part of a remapping attack potentially impacting data confidentiality, integrity, or availability."}],"id":"CVE-2024-36309","lastModified":"2026-11-10T23:17:18.420","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:18.420","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3051.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1233"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI 1.0.0.G"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.H"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Rome-1.0.0.P"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Naples-1.0.0.S"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.1.0.3h"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI 1.0.0.5"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI300A Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MI300A 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.3.0.1a"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6_1.0.0.Ec"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.Bh"}]},{"defaultStatus":"affected","product":"AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1 PI-1.0.0.3m"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.H"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 3000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"CastlePeakPI-SP3r3_1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.0.0.1l"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.1.0.3h"},{"status":"unaffected","version":"ComboAM5PI_1.2.0.3k"},{"status":"unaffected","version":"ComboAM5PI 1.3.0.1b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.2.0.3k"},{"status":"unaffected","version":"ComboAM5PI 1.3.0.1a"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4 1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.Bh"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixHaloPI-FP11_1.0.0.1"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000HX Series Mobile Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"FireRangeFL1PI 1.0.0.0f"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"SnowyOwl_SP4_SP4r2.1.1.0.H"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbRomePI-SP3 1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 v9 1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors - Genoa","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors - Bergamo","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 5000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbAM4PI 1008"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 7000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 8000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPhoenixPI-FP7r2_1.0.0.2"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 9000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R1000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP5 1211"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedR2KPI-FP5 1006"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP5 1211"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP6_1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1012"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled device as part of a remapping attack potentially impacting data confidentiality, integrity, or availability."}],"id":"CVE-2024-36309","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:18.420","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3051.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1233"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2024/CVE-2024-36344.json b/data/2024/CVE-2024-36344.json new file mode 100644 index 0000000000..318ea8fea2 --- /dev/null +++ b/data/2024/CVE-2024-36344.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI 1.0.0.6"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6_1.0.0.Ec"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.BD"}]},{"defaultStatus":"affected","product":"AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1 1.0.0.3h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.0.0.B"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"},{"status":"unaffected","version":"ComboAM5PI 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.H"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 3000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"CastlePeakPI-SP3r3_1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.0.0.1l"},{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"},{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4PI 1.0.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.BD"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R1000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP5 1211"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedR2KPI-FP5 1006"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP5 1211"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 5000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbAM4PI 1.0.0.9"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 7000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.4​"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP6_1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1011"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbTurinPI-SP5_1.0.0.1"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 8000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPhoenixPI-FP7r2_1.0.0.2"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 9000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.5"}]},{"defaultStatus":"affected","product":"AMD Radeon™ RX 5000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO W5000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: PRO Edition 25.Q2 (25.10.10)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ RX 6000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ RX 7000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO W6000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: PRO Edition 25.Q2 (25.10.10)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO W7000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: PRO Edition 25.Q2 (25.10.10)"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI210","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI250","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI300A","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI300X","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI308","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI325X","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO V520","vendor":"AMD","versions":[{"status":"unaffected","version":"Contact your AMD Customer Engineering representative"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO V620","vendor":"AMD","versions":[{"status":"unaffected","version":"Contact your AMD Customer Engineering representative"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO V710","vendor":"AMD","versions":[{"status":"unaffected","version":"Contact your AMD Customer Engineering representative"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with local access to the Trusted Execution Environment (TEE) interface or Trusted Application (TA) to cause an out-of-bounds write, potentially resulting in a loss of platform integrity or denial of service."}],"id":"CVE-2024-36344","lastModified":"2026-11-12T20:18:12.150","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:12.150","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3057.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6028.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2024/CVE-2024-36350.json b/data/2024/CVE-2024-36350.json index 6213335bf7..a6bec0abcd 100644 --- a/data/2024/CVE-2024-36350.json +++ b/data/2024/CVE-2024-36350.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI 1.0.0.G + OS Updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI 1.0.0.E + OS Updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI 1.0.0.E + OS Updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9V64H Processor","vendor":"AMD","versions":[{"status":"unaffected","version":"MI300PI 1.0.0.7 + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.E + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.E + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3 + OS Updates"},{"status":"unaffected","version":"ComboAM5PI 1.0.0.a+ OS Updates"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3c+ OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3 + OS Updates"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3c+ OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6 1.1.0.0i + OS Updates"},{"status":"unaffected","version":"StormPeakPI-SP6 1.0.0.1k + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7 1.0.0.Bb + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7 1.0.0.Bb + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6 1.0.1.1b + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7 1.2.0.0 + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7 1.2.0.0 + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Mobile Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1 1.0.0.3g + OS Updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.A + OS updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.9 + OS updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.9 + OS updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 5000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbAM4PI 1.0.0.7 + OS Update"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 7000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.3 + OS updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 100C + OS updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 97X4","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.9 + OS updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6 1.0.1.1b + OS Updates"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information."},{"lang":"es","value":"Una vulnerabilidad de ejecución transitoria en algunos AMD processors puede permitir que un atacante infiera datos de almacenamientos anteriores, lo que podría resultar en la fuga de información privilegiada."}],"id":"CVE-2024-36350","lastModified":"2026-06-17T07:36:33.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.1,"impactScore":4.0,"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-36350","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-07-08T20:23:14.382306Z","version":"2.0.3"}}]},"published":"2025-07-08T17:15:31.563","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2025/08/28/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-471.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.3.0.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000HX Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"FireRangeFL1 PI-1.0.0.0i"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0h"},{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.2g"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3l"},{"status":"unaffected","version":"ComboAM5PI 1.3.0.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 400 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GorgonHaloPI-FP11_1.0.0.0a"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixHalo PI-FP11_1.0.0.2d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI400 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.3.0.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Z2 Extreme","vendor":"AMD","versions":[{"status":"unaffected","version":"GorgonPI-FP8_1.0.0.2e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6 1.0.0.1h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 400 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GorgonPI-FP8_1.0.0.2e"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI_1.0.0.9"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 9000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI_1.0.0.9"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded P100 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedP100 PI 1000"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 2005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedFireRangeFL1_1.0.0.5"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information."},{"lang":"es","value":"Una vulnerabilidad de ejecución transitoria en algunos AMD processors puede permitir que un atacante infiera datos de almacenamientos anteriores, lo que podría resultar en la fuga de información privilegiada."}],"id":"CVE-2024-36350","lastModified":"2026-11-12T20:18:12.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.1,"impactScore":4.0,"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-36350","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-07-08T20:23:14.382306Z","version":"2.0.3"}}]},"published":"2025-07-08T17:15:31.563","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7073.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2025/08/28/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-471.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Deferred"} diff --git a/data/2024/CVE-2024-36357.json b/data/2024/CVE-2024-36357.json index 1dd4dbe3bc..af57b5fd55 100644 --- a/data/2024/CVE-2024-36357.json +++ b/data/2024/CVE-2024-36357.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI 1.0.0.G + OS Updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI 1.0.0.E + OS Updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI 1.0.0.E + OS Updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9V64H Processor","vendor":"AMD","versions":[{"status":"unaffected","version":"MI300PI 1.0.0.7 + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.E + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.E + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3 + OS Updates"},{"status":"unaffected","version":"ComboAM5PI 1.0.0.a+ OS Updates"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3c+ OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3 + OS Updates"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3c+ OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6 1.1.0.0i + OS Updates"},{"status":"unaffected","version":"StormPeakPI-SP6 1.0.0.1k + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7 1.0.0.Bb + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7 1.0.0.Bb + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6 1.0.1.1b + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7 1.2.0.0 + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7 1.2.0.0 + OS Updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Mobile Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1 1.0.0.3g + OS Updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.A + OS updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.9 + OS updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.9 + OS updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 5000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbAM4PI 1.0.0.7 + OS Update"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 7000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.3 + OS updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 100C + OS updates"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 97X4","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbGenoaPI-SP5 1.0.0.9 + OS updates"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6 1.0.1.1b + OS Updates"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries."},{"lang":"es","value":"Una vulnerabilidad de ejecución transitoria en algunos AMD processors puede permitir que un atacante infiera datos en la memoria caché L1D, lo que podría resultar en la fuga de información confidencial a través de los límites privilegiados."}],"id":"CVE-2024-36357","lastModified":"2026-06-17T07:36:34.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.1,"impactScore":4.0,"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-36357","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-07-09T13:36:59.777404Z","version":"2.0.3"}}]},"published":"2025-07-08T17:15:31.723","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2025/08/28/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-471.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.3.0.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000HX Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"FireRangeFL1 PI-1.0.0.0i"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0h"},{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.2g"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3l"},{"status":"unaffected","version":"ComboAM5PI 1.3.0.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 400 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GorgonHaloPI-FP11_1.0.0.0a"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixHalo PI-FP11_1.0.0.2d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI400 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.3.0.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Z2 Extreme","vendor":"AMD","versions":[{"status":"unaffected","version":"GorgonPI-FP8_1.0.0.2e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6 1.0.0.1h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 400 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GorgonPI-FP8_1.0.0.2e"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 9000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI_1.0.0.9"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded P100 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedP100 PI 1000"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 2005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedFireRangeFL1_1.0.0.5"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI_1.0.0.9"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries."},{"lang":"es","value":"Una vulnerabilidad de ejecución transitoria en algunos AMD processors puede permitir que un atacante infiera datos en la memoria caché L1D, lo que podría resultar en la fuga de información confidencial a través de los límites privilegiados."}],"id":"CVE-2024-36357","lastModified":"2026-11-12T20:18:13.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.1,"impactScore":4.0,"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-36357","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-07-09T13:36:59.777404Z","version":"2.0.3"}}]},"published":"2025-07-08T17:15:31.723","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7073.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2025/08/28/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-471.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Deferred"} diff --git a/data/2025/CVE-2025-0008.json b/data/2025/CVE-2025-0008.json index 77ec439e04..f2771173d9 100644 --- a/data/2025/CVE-2025-0008.json +++ b/data/2025/CVE-2025-0008.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI 1.0.0.G"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"RomePI-SP3_1.0.0.Q"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"NaplesPI-SP3_1.0.0.T"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.I"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4 1.0.0.10"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedRomePI-SP3 1.0.0.G"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"SnowyOwl_SP4_SP4r2.1.1.0.I"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially resulting in unauthorized debug access."}],"id":"CVE-2025-0008","lastModified":"2026-11-10T23:17:18.703","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:18.703","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3049.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI 1.0.0.G"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"RomePI-SP3_1.0.0.Q"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"NaplesPI-SP3_1.0.0.T"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.I"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4 1.0.0.10"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedRomePI-SP3 1.0.0.G"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"SnowyOwl_SP4_SP4r2.1.1.0.I"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially resulting in unauthorized debug access."}],"id":"CVE-2025-0008","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:18.703","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3049.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-0027.json b/data/2025/CVE-2025-0027.json index b197859830..8e383708b9 100644 --- a/data/2025/CVE-2025-0027.json +++ b/data/2025/CVE-2025-0027.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially impacting the integrity of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory."}],"id":"CVE-2025-0027","lastModified":"2026-11-10T22:17:44.427","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:44.427","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially impacting the integrity of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory."}],"id":"CVE-2025-0027","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:44.427","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-0043.json b/data/2025/CVE-2025-0043.json new file mode 100644 index 0000000000..e432ee9072 --- /dev/null +++ b/data/2025/CVE-2025-0043.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Vivado Software","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution."}],"id":"CVE-2025-0043","lastModified":"2026-11-12T20:18:13.827","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:13.827","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8024.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-10698.json b/data/2025/CVE-2025-10698.json new file mode 100644 index 0000000000..6dafad1844 --- /dev/null +++ b/data/2025/CVE-2025-10698.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows","Linux","64 bit"],"product":"Identity Console","vendor":"OpenText","versions":[{"changes":[{"at":"25.2","status":"unaffected"}],"lessThan":"25.2","status":"affected","version":"1.8","versionType":"rpm, exe"}]}],"source":"security@opentext.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity Console on Windows, Linux, and 64 bit allows Retrieve Embedded Sensitive Data.\n\nThis issue affects Identity Console: from 1.8 through 25.2."}],"id":"CVE-2025-10698","lastModified":"2026-11-12T17:17:20.973","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"LOW"},"source":"security@opentext.com","type":"Secondary"}]},"published":"2026-11-12T17:17:20.800","references":[{"source":"security@opentext.com","url":"https://docs.microfocus.com/doc/29/25.4/securityandsoftwarefixes"}],"sourceIdentifier":"security@opentext.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"},{"lang":"en","value":"CWE-1269"}],"source":"security@opentext.com","type":"Primary"}]} diff --git a/data/2025/CVE-2025-15711.json b/data/2025/CVE-2025-15711.json index 4b02496a5b..2b6920a639 100644 --- a/data/2025/CVE-2025-15711.json +++ b/data/2025/CVE-2025-15711.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."}],"id":"CVE-2025-15711","lastModified":"2026-11-11T12:18:11.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15711","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:36.250909Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:08.427","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/3c296d09-122f-420e-9ab1-81ffdfff88c2/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."}],"id":"CVE-2025-15711","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15711","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:36.250909Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:08.427","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/3c296d09-122f-420e-9ab1-81ffdfff88c2/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-15712.json b/data/2025/CVE-2025-15712.json index 90c142772c..00f1341d4c 100644 --- a/data/2025/CVE-2025-15712.json +++ b/data/2025/CVE-2025-15712.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."}],"id":"CVE-2025-15712","lastModified":"2026-11-11T12:18:12.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15712","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:23.457888Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.033","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/00d2c75d-7e8f-4f6c-8b72-c66b1bb6cc59/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."}],"id":"CVE-2025-15712","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15712","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:23.457888Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.033","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/00d2c75d-7e8f-4f6c-8b72-c66b1bb6cc59/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-15713.json b/data/2025/CVE-2025-15713.json index f42af8e00b..3de42a9ff2 100644 --- a/data/2025/CVE-2025-15713.json +++ b/data/2025/CVE-2025-15713.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups."}],"id":"CVE-2025-15713","lastModified":"2026-11-11T12:18:13.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15713","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:04.856633Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.167","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/eb5d2c5b-0035-4c84-876a-b4268e27e3cc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups."}],"id":"CVE-2025-15713","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15713","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:04.856633Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.167","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/eb5d2c5b-0035-4c84-876a-b4268e27e3cc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-15714.json b/data/2025/CVE-2025-15714.json index a1498b9fd0..8e6b1e876f 100644 --- a/data/2025/CVE-2025-15714.json +++ b/data/2025/CVE-2025-15714.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."}],"id":"CVE-2025-15714","lastModified":"2026-11-11T12:18:13.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15714","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:53.148629Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.293","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/03a1c844-9a9f-4702-ba6c-3ada3e779014/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."}],"id":"CVE-2025-15714","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15714","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:53.148629Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.293","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/03a1c844-9a9f-4702-ba6c-3ada3e779014/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-29940.json b/data/2025/CVE-2025-29940.json index 524835deac..ebbc7c055a 100644 --- a/data/2025/CVE-2025-29940.json +++ b/data/2025/CVE-2025-29940.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to a malicious hypervisor to overwrite guest memory if segmented Reverse Map Table (RMP) is enabled potentially resulting in loss of guest data integrity."}],"id":"CVE-2025-29940","lastModified":"2026-11-10T22:17:45.890","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:45.890","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-283"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to a malicious hypervisor to overwrite guest memory if segmented Reverse Map Table (RMP) is enabled potentially resulting in loss of guest data integrity."}],"id":"CVE-2025-29940","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:45.890","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-283"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-29941.json b/data/2025/CVE-2025-29941.json index 10d9d5cea7..695de6b3c4 100644 --- a/data/2025/CVE-2025-29941.json +++ b/data/2025/CVE-2025-29941.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor or migration agent to import a forged guest context potentially resulting in loss of confidentiality for derived guest keys."}],"id":"CVE-2025-29941","lastModified":"2026-11-10T23:17:18.863","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:18.863","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-335"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor or migration agent to import a forged guest context potentially resulting in loss of confidentiality for derived guest keys."}],"id":"CVE-2025-29941","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:18.863","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-335"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-48504.json b/data/2025/CVE-2025-48504.json index e3c63842a8..b717ce1b69 100644 --- a/data/2025/CVE-2025-48504.json +++ b/data/2025/CVE-2025-48504.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to manipulate metadata pages potentially resulting in the loss of confidentiality and integrity of guest memory."}],"id":"CVE-2025-48504","lastModified":"2026-11-10T23:17:19.017","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:19.017","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to manipulate metadata pages potentially resulting in the loss of confidentiality and integrity of guest memory."}],"id":"CVE-2025-48504","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:19.017","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-52535.json b/data/2025/CVE-2025-52535.json index 9ed176b0f5..86d8981cfd 100644 --- a/data/2025/CVE-2025-52535.json +++ b/data/2025/CVE-2025-52535.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper resource reuse in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to write to the Reverse Map Table (RMP) protected memory, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2025-52535","lastModified":"2026-11-10T22:17:46.027","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.027","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper resource reuse in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to write to the Reverse Map Table (RMP) protected memory, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2025-52535","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.027","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-52537.json b/data/2025/CVE-2025-52537.json index b1d3b78faa..93f694f6ea 100644 --- a/data/2025/CVE-2025-52537.json +++ b/data/2025/CVE-2025-52537.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to tamper with memory, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2025-52537","lastModified":"2026-11-10T22:17:46.163","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.163","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to tamper with memory, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2025-52537","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.163","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54501.json b/data/2025/CVE-2025-54501.json new file mode 100644 index 0000000000..c402681a6c --- /dev/null +++ b/data/2025/CVE-2025-54501.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access controls potentially resulting in a loss of SEV-SNP guest memory integrity."}],"id":"CVE-2025-54501","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T19:16:45.017","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3054.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1191"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54503.json b/data/2025/CVE-2025-54503.json index d5a411d199..548a0ccb13 100644 --- a/data/2025/CVE-2025-54503.json +++ b/data/2025/CVE-2025-54503.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of overlap between protected memory ranges in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker to cause misconfigurations in the RMP potentially resulting in loss of integrity."}],"id":"CVE-2025-54503","lastModified":"2026-11-10T22:17:46.317","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.317","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1260"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of overlap between protected memory ranges in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker to cause misconfigurations in the RMP potentially resulting in loss of integrity."}],"id":"CVE-2025-54503","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.317","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1260"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54504.json b/data/2025/CVE-2025-54504.json index 6fb5b56277..edfde73495 100644 --- a/data/2025/CVE-2025-54504.json +++ b/data/2025/CVE-2025-54504.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), potentially resulting in loss of integrity."}],"id":"CVE-2025-54504","lastModified":"2026-11-10T22:17:46.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.470","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), potentially resulting in loss of integrity."}],"id":"CVE-2025-54504","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.470","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54506.json b/data/2025/CVE-2025-54506.json index 2faebee044..e31f3176e0 100644 --- a/data/2025/CVE-2025-54506.json +++ b/data/2025/CVE-2025-54506.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially resulting in loss of guest integrity."}],"id":"CVE-2025-54506","lastModified":"2026-11-10T22:17:46.640","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.640","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially resulting in loss of guest integrity."}],"id":"CVE-2025-54506","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.640","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54507.json b/data/2025/CVE-2025-54507.json new file mode 100644 index 0000000000..b75946ec8f --- /dev/null +++ b/data/2025/CVE-2025-54507.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP entries for the same guest physical address, potentially resulting in loss of guest integrity."}],"id":"CVE-2025-54507","lastModified":"2026-11-12T20:18:14.030","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.030","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3058.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1288"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54508.json b/data/2025/CVE-2025-54508.json index b6f0577ccd..6e43c09602 100644 --- a/data/2025/CVE-2025-54508.json +++ b/data/2025/CVE-2025-54508.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of Reverse Map Table (RMP) entries in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker to trigger concurrent modifications to RMP entries without proper synchronization potentially resulting in loss of data integrity."}],"id":"CVE-2025-54508","lastModified":"2026-11-10T22:17:46.807","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.807","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-179"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of Reverse Map Table (RMP) entries in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker to trigger concurrent modifications to RMP entries without proper synchronization potentially resulting in loss of data integrity."}],"id":"CVE-2025-54508","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.807","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-179"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54991.json b/data/2025/CVE-2025-54991.json index 4aace3a20f..7b03d20a30 100644 --- a/data/2025/CVE-2025-54991.json +++ b/data/2025/CVE-2025-54991.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"jupyterlab-desktop","vendor":"jupyterlab","versions":[{"status":"affected","version":"< 4.6.2-1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to honor DYLD_INSERT_LIBRARIES despite the hardened runtime. An attacker who can already execute code as the current user can load an arbitrary dynamic library into the JupyterLab Desktop process and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1."},{"lang":"es","value":"JupyterLab Desktop es la aplicación de escritorio multiplataforma para JupyterLab. Versiones anteriores a la 4.6.2-1 de JupyterLab Desktop para macOS declaraban el derecho com.apple.security.cs.allow-dyld-environment-variables, permitiendo que el enlazador dinámico respetara DYLD_INSERT_LIBRARIES a pesar del entorno de ejecución reforzado. Un atacante que ya puede ejecutar código como el usuario actual puede cargar una biblioteca dinámica arbitraria en el proceso de JupyterLab Desktop y heredar los permisos TCC previamente otorgados a la aplicación, incluido el acceso a las carpetas protegidas de Documentos, Escritorio o Descargas sin otra solicitud de macOS. La explotación requiere la ejecución de código local existente y concesiones TCC previas; no proporciona ejecución de código inicial ni ejecución remota de código. Windows y Linux no se ven afectados. Esta vulnerabilidad se corrige en la versión 4.6.2-1."}],"id":"CVE-2025-54991","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54991","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T13:22:20.769074Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:04.210","references":[{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/commit/302fb36caca62bbbba7bfaaf0a4966a38cbead44"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-8cvf-4977-r95v"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"jupyterlab-desktop","vendor":"jupyterlab","versions":[{"status":"affected","version":"< 4.6.2-1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to honor DYLD_INSERT_LIBRARIES despite the hardened runtime. An attacker who can already execute code as the current user can load an arbitrary dynamic library into the JupyterLab Desktop process and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1."},{"lang":"es","value":"JupyterLab Desktop es la aplicación de escritorio multiplataforma para JupyterLab. Versiones anteriores a la 4.6.2-1 de JupyterLab Desktop para macOS declaraban el derecho com.apple.security.cs.allow-dyld-environment-variables, permitiendo que el enlazador dinámico respetara DYLD_INSERT_LIBRARIES a pesar del entorno de ejecución reforzado. Un atacante que ya puede ejecutar código como el usuario actual puede cargar una biblioteca dinámica arbitraria en el proceso de JupyterLab Desktop y heredar los permisos TCC previamente otorgados a la aplicación, incluido el acceso a las carpetas protegidas de Documentos, Escritorio o Descargas sin otra solicitud de macOS. La explotación requiere la ejecución de código local existente y concesiones TCC previas; no proporciona ejecución de código inicial ni ejecución remota de código. Windows y Linux no se ven afectados. Esta vulnerabilidad se corrige en la versión 4.6.2-1."}],"id":"CVE-2025-54991","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54991","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T13:22:20.769074Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:04.210","references":[{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/commit/302fb36caca62bbbba7bfaaf0a4966a38cbead44"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-8cvf-4977-r95v"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-61625.json b/data/2025/CVE-2025-61625.json index 49d3313a2f..7a8ca647cf 100644 --- a/data/2025/CVE-2025-61625.json +++ b/data/2025/CVE-2025-61625.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.10","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.11, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10 may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests."}],"id":"CVE-2025-61625","lastModified":"2026-11-11T05:19:14.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-61625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.203","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-190"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.10","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.11, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10 may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests."}],"id":"CVE-2025-61625","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-61625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.203","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-190"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-62620.json b/data/2025/CVE-2025-62620.json index e96fa4dd30..9a9fabf9e2 100644 --- a/data/2025/CVE-2025-62620.json +++ b/data/2025/CVE-2025-62620.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2025-62620","lastModified":"2026-11-10T22:17:46.990","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.990","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1289"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2025-62620","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:46.990","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1289"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-62621.json b/data/2025/CVE-2025-62621.json index 6ab733d9e8..d93d17958e 100644 --- a/data/2025/CVE-2025-62621.json +++ b/data/2025/CVE-2025-62621.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Expected behavior violation in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially resulting in a loss of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory integrity."}],"id":"CVE-2025-62621","lastModified":"2026-11-10T22:17:47.160","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:47.160","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Expected behavior violation in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially resulting in a loss of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory integrity."}],"id":"CVE-2025-62621","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:17:47.160","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0003.json b/data/2026/CVE-2026-0003.json index b1ee76b74a..19626b1cab 100644 --- a/data/2026/CVE-2026-0003.json +++ b/data/2026/CVE-2026-0003.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality."}],"id":"CVE-2026-0003","lastModified":"2026-11-10T23:17:19.190","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:19.190","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality."}],"id":"CVE-2026-0003","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:19.190","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0004.json b/data/2026/CVE-2026-0004.json new file mode 100644 index 0000000000..2369eb97aa --- /dev/null +++ b/data/2026/CVE-2026-0004.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000HX Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"FireRangeFL1 PI-1.0.0.0i"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0h"},{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.2g"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.2.0.3l"},{"status":"unaffected","version":"ComboAM5PI_1.3.0.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 400 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GorgonHalo PI FP11_1.0.0.0b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixHalo PI-FP11_1.0.0.2d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 400 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.3.0.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Z1 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Z2 Series Processors Extreme","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6-1.0.0.1h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6-1.0.0.1h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 400 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GorgonPI-FP8_1.0.0.2e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 9000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6-1.0.0.1h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6-1.0.0.1h"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 9000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI_1.0.0.9"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 2005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedFireRangeFL1_1.0.0.5"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded P100 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedP100 PI 1000"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A transient execution vulnerability in some AMD processors may allow an attacker with the ability to execute code on the system to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries."}],"id":"CVE-2026-0004","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T19:16:45.160","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3055.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis"} diff --git a/data/2026/CVE-2026-0101.json b/data/2026/CVE-2026-0101.json new file mode 100644 index 0000000000..160e07da74 --- /dev/null +++ b/data/2026/CVE-2026-0101.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local attacker to pass unsanitized input, potentially resulting in a system crash or denial of service."}],"id":"CVE-2026-0101","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T19:16:45.317","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3056.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0324.json b/data/2026/CVE-2026-0324.json index 654c391b89..0ecbffe999 100644 --- a/data/2026/CVE-2026-0324.json +++ b/data/2026/CVE-2026-0324.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"MetaDefender Endpoint Security SDK","vendor":"OPSWAT","versions":[{"changes":[{"at":"4.3.4822","status":"unaffected"}],"lessThan":"4.3.4822","status":"affected","version":"4.3.0","versionType":"custom"}]}],"source":"psirt@paloaltonetworks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\\SYSTEM."}],"id":"CVE-2026-0324","lastModified":"2026-11-11T20:16:59.480","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:X/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@paloaltonetworks.com","type":"Secondary"}]},"published":"2026-11-11T20:16:59.480","references":[{"source":"psirt@paloaltonetworks.com","url":"https://security.paloaltonetworks.com/CVE-2026-0324"}],"sourceIdentifier":"psirt@paloaltonetworks.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-266"}],"source":"psirt@paloaltonetworks.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"MetaDefender Endpoint Security SDK","vendor":"OPSWAT","versions":[{"changes":[{"at":"4.3.4822","status":"unaffected"}],"lessThan":"4.3.4822","status":"affected","version":"4.3.0","versionType":"custom"}]}],"source":"psirt@paloaltonetworks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\\SYSTEM."}],"id":"CVE-2026-0324","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:X/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@paloaltonetworks.com","type":"Secondary"}]},"published":"2026-11-11T20:16:59.480","references":[{"source":"psirt@paloaltonetworks.com","url":"https://security.paloaltonetworks.com/CVE-2026-0324"}],"sourceIdentifier":"psirt@paloaltonetworks.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-266"}],"source":"psirt@paloaltonetworks.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0435.json b/data/2026/CVE-2026-0435.json index 83cb5f1758..2f2d2f72bc 100644 --- a/data/2026/CVE-2026-0435.json +++ b/data/2026/CVE-2026-0435.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to swap out a guest device without the guest's knowledge, potentially resulting in a loss of confidentiality and integrity."}],"id":"CVE-2026-0435","lastModified":"2026-11-10T23:17:19.340","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:19.340","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to swap out a guest device without the guest's knowledge, potentially resulting in a loss of confidentiality and integrity."}],"id":"CVE-2026-0435","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:19.340","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0436.json b/data/2026/CVE-2026-0436.json new file mode 100644 index 0000000000..9cc1056329 --- /dev/null +++ b/data/2026/CVE-2026-0436.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI300C","vendor":"AMD","versions":[{"status":"unaffected","version":"MI300C 1.0.0.3"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an attacker to supply malicious input, potentially resulting in loss of platform integrity, memory leakage, or denial of service."}],"id":"CVE-2026-0436","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T19:16:45.467","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3053.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0454.json b/data/2026/CVE-2026-0454.json index 1e378305a7..62fff81807 100644 --- a/data/2026/CVE-2026-0454.json +++ b/data/2026/CVE-2026-0454.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to corrupt global firmware variables, potentially resulting in loss of integrity."}],"id":"CVE-2026-0454","lastModified":"2026-11-10T23:17:19.473","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:19.473","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to corrupt global firmware variables, potentially resulting in loss of integrity."}],"id":"CVE-2026-0454","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:19.473","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0455.json b/data/2026/CVE-2026-0455.json new file mode 100644 index 0000000000..8b9ef7be34 --- /dev/null +++ b/data/2026/CVE-2026-0455.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Versal™ AI Edge Series Gen 2 Adaptive SoCs","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]},{"defaultStatus":"affected","product":"Versal™ Prime Series Gen 2 Adaptive SoCs (2VM3358, 2VM3558, and 2VM3858 only)","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]},{"defaultStatus":"affected","product":"VivadoTM Advanced Configuration Editor for Versal™ AI Edge Series Gen 2","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthorized access as expected. This allows processors in the SoC with any IPI channel access the ability to both read and write to the entire IPI buffer register space as well as the IPI no-buffer register control space."}],"id":"CVE-2026-0455","lastModified":"2026-11-12T20:18:14.237","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.237","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8027.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0460.json b/data/2026/CVE-2026-0460.json new file mode 100644 index 0000000000..94d60c427c --- /dev/null +++ b/data/2026/CVE-2026-0460.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Bootgen","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, potentially impacting data integrity."}],"id":"CVE-2026-0460","lastModified":"2026-11-12T20:18:14.440","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":1.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.440","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8025.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0470.json b/data/2026/CVE-2026-0470.json index d2e5809d7d..e03d661d86 100644 --- a/data/2026/CVE-2026-0470.json +++ b/data/2026/CVE-2026-0470.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded Snowyowl Chipset Driver - 8.10.28.647 (73744e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R1000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability."}],"id":"CVE-2026-0470","lastModified":"2026-11-11T14:17:27.200","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-11T14:17:27.200","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5010.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded Snowyowl Chipset Driver - 8.10.28.647 (73744e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R1000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability."}],"id":"CVE-2026-0470","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-11T14:17:27.200","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5010.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0480.json b/data/2026/CVE-2026-0480.json index 9a1dbbbe7e..e5fdea1351 100644 --- a/data/2026/CVE-2026-0480.json +++ b/data/2026/CVE-2026-0480.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to forge SEV-TIO guest request messages potentially compromising SEV-SNP guest memory integrity and confidentiality."}],"id":"CVE-2026-0480","lastModified":"2026-11-10T23:17:19.607","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:19.607","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to forge SEV-TIO guest request messages potentially compromising SEV-SNP guest memory integrity and confidentiality."}],"id":"CVE-2026-0480","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T23:17:19.607","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-100307.json b/data/2026/CVE-2026-100307.json index ca7ae68b33..518f9a61d8 100644 --- a/data/2026/CVE-2026-100307.json +++ b/data/2026/CVE-2026-100307.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mcp-gateway-registry","vendor":"AWS","versions":[{"lessThanOrEqual":"1.24.7","status":"affected","version":"1.0.9","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.25.0."}],"id":"CVE-2026-100307","lastModified":"2026-11-11T21:16:41.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-11T21:16:41.933","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-179-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.25.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/security/advisories/GHSA-rxf3-qgpv-wxvr"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-862"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mcp-gateway-registry","vendor":"AWS","versions":[{"lessThanOrEqual":"1.24.7","status":"affected","version":"1.0.9","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.25.0."}],"id":"CVE-2026-100307","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-11T21:16:41.933","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-179-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.25.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/security/advisories/GHSA-rxf3-qgpv-wxvr"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-862"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-100407.json b/data/2026/CVE-2026-100407.json index a0126e5507..33777a8525 100644 --- a/data/2026/CVE-2026-100407.json +++ b/data/2026/CVE-2026-100407.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"git","vendor":"git-for-windows","versions":[{"status":"affected","version":">= 2.44.0.windows.1, < 2.55.0.windows.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3."}],"id":"CVE-2026-100407","lastModified":"2026-11-05T19:16:59.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-100407","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:41:14.929892Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:21.797","references":[{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d"},{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3"},{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"git","vendor":"git-for-windows","versions":[{"status":"affected","version":">= 2.44.0.windows.1, < 2.55.0.windows.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3."}],"id":"CVE-2026-100407","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-100407","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:41:14.929892Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:21.797","references":[{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d"},{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3"},{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-100408.json b/data/2026/CVE-2026-100408.json index 0715dea1bf..a10550fc92 100644 --- a/data/2026/CVE-2026-100408.json +++ b/data/2026/CVE-2026-100408.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"git","vendor":"git-for-windows","versions":[{"status":"affected","version":">= 2.43.0.windows.1, < 2.55.0.windows.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3."}],"id":"CVE-2026-100408","lastModified":"2026-11-09T17:17:05.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-100408","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:20:25.703182Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:21.997","references":[{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756"},{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3"},{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"git","vendor":"git-for-windows","versions":[{"status":"affected","version":">= 2.43.0.windows.1, < 2.55.0.windows.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3."}],"id":"CVE-2026-100408","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-100408","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:20:25.703182Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:21.997","references":[{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756"},{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3"},{"source":"security-advisories@github.com","url":"https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-100962.json b/data/2026/CVE-2026-100962.json index b983e0a575..9075a5cffd 100644 --- a/data/2026/CVE-2026-100962.json +++ b/data/2026/CVE-2026-100962.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["All"],"product":"Nemo Deploy","vendor":"NVIDIA","versions":[{"status":"affected","version":"0-0.7.0"}]}],"source":"psirt@nvidia.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might cause information disclosure."}],"id":"CVE-2026-100962","lastModified":"2026-11-10T13:18:18.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@nvidia.com","type":"Secondary"}]},"published":"2026-11-10T13:18:18.693","references":[{"source":"psirt@nvidia.com","url":"https://github.com/NVIDIA/product-security/tree/main/2026/5920"},{"source":"psirt@nvidia.com","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100962"},{"source":"psirt@nvidia.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-100962"}],"sourceIdentifier":"psirt@nvidia.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@nvidia.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["All"],"product":"Nemo Deploy","vendor":"NVIDIA","versions":[{"status":"affected","version":"0-0.7.0"}]}],"source":"psirt@nvidia.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might cause information disclosure."}],"id":"CVE-2026-100962","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@nvidia.com","type":"Secondary"}]},"published":"2026-11-10T13:18:18.693","references":[{"source":"psirt@nvidia.com","url":"https://github.com/NVIDIA/product-security/tree/main/2026/5920"},{"source":"psirt@nvidia.com","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100962"},{"source":"psirt@nvidia.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-100962"}],"sourceIdentifier":"psirt@nvidia.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@nvidia.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-101031.json b/data/2026/CVE-2026-101031.json index c904ab9333..464cb11f86 100644 --- a/data/2026/CVE-2026-101031.json +++ b/data/2026/CVE-2026-101031.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"3.0.5","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production."}],"id":"CVE-2026-101031","lastModified":"2026-11-10T21:12:53.670","metrics":{},"published":"2026-11-09T10:17:02.313","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73787"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/p53zxybld58wv722c7zxk0w8d2rnkfwk"},{"source":"security@apache.org","url":"https://www.cve.org/CVERecord?id=CVE-2025-54941"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"3.0.5","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example Dags are loaded (`load_examples` enabled), a user who can trigger that Dag with a custom `url` parameter could point it at a server whose response injects shell commands run on the worker. This is an incomplete fix for CVE-2025-54941; users who upgraded for CVE-2025-54941 should upgrade again. Users are advised to upgrade to apache-airflow 3.4.0 or later, or to disable example Dags (`load_examples = False`), which is recommended for production."}],"id":"CVE-2026-101031","lastModified":"2026-11-12T17:17:21.047","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-101031","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:10:18.854842Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:02.313","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73787"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/p53zxybld58wv722c7zxk0w8d2rnkfwk"},{"source":"security@apache.org","url":"https://www.cve.org/CVERecord?id=CVE-2025-54941"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-101107.json b/data/2026/CVE-2026-101107.json index 84d2abdae2..089b42626f 100644 --- a/data/2026/CVE-2026-101107.json +++ b/data/2026/CVE-2026-101107.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Air Terminal 6","vendor":"SoftBank Corp.","versions":[{"lessThanOrEqual":"v1.01.80","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. Arbitrary commands may be executed with the root privilege by a user who can log in to the web management console of the affected product."}],"id":"CVE-2026-101107","lastModified":"2026-11-12T06:17:10.053","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}]},"published":"2026-11-12T06:17:10.053","references":[{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/jp/JVN64740097/"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"vultures@jpcert.or.jp","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Air Terminal 6","vendor":"SoftBank Corp.","versions":[{"lessThanOrEqual":"v1.01.80","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. Arbitrary commands may be executed with the root privilege by a user who can log in to the web management console of the affected product."}],"id":"CVE-2026-101107","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}]},"published":"2026-11-12T06:17:10.053","references":[{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/jp/JVN64740097/"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"vultures@jpcert.or.jp","type":"Primary"}]} diff --git a/data/2026/CVE-2026-101275.json b/data/2026/CVE-2026-101275.json index b9f59a34f2..eec298701d 100644 --- a/data/2026/CVE-2026-101275.json +++ b/data/2026/CVE-2026-101275.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"pretix-adyen","product":"pretix-adyen","repo":"https://github.com/pretix/pretix-adyen","vendor":"pretix","versions":[{"lessThan":"1.5.4","status":"affected","version":"0","versionType":"python"}]}],"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment."}],"id":"CVE-2026-101275","lastModified":"2026-11-10T12:17:16.073","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6","type":"Secondary"}]},"published":"2026-11-10T12:17:16.073","references":[{"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6","url":"https://pretix.eu/about/en/blog/20261110-adyen/"}],"sourceIdentifier":"655498c3-6ec5-4f0b-aea6-853b334d05a6","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"pretix-adyen","product":"pretix-adyen","repo":"https://github.com/pretix/pretix-adyen","vendor":"pretix","versions":[{"lessThan":"1.5.4","status":"affected","version":"0","versionType":"python"}]}],"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment."}],"id":"CVE-2026-101275","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6","type":"Secondary"}]},"published":"2026-11-10T12:17:16.073","references":[{"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6","url":"https://pretix.eu/about/en/blog/20261110-adyen/"}],"sourceIdentifier":"655498c3-6ec5-4f0b-aea6-853b334d05a6","vulnStatus":"Awaiting Analysis"} diff --git a/data/2026/CVE-2026-101604.json b/data/2026/CVE-2026-101604.json index ef7cf7c47c..ac1cb4a369 100644 --- a/data/2026/CVE-2026-101604.json +++ b/data/2026/CVE-2026-101604.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Oracle Communications Unified Inventory Management","vendor":"Oracle Corporation","versions":[{"status":"affected","version":"7.5.0","versionType":"semver"},{"status":"affected","version":"7.5.1","versionType":"semver"},{"status":"affected","version":"7.6.0","versionType":"semver"},{"status":"affected","version":"7.7.0","versionType":"semver"},{"status":"affected","version":"7.8.0","versionType":"semver"},{"status":"affected","version":"8.0.1","versionType":"semver"}]}],"source":"secalert_us@oracle.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}],"id":"CVE-2026-101604","lastModified":"2026-10-21T18:43:53.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert_us@oracle.com","type":"Primary"}]},"published":"2026-10-20T22:18:14.087","references":[{"source":"secalert_us@oracle.com","url":"https://www.oracle.com/security-alerts/cpuoct2026.html"}],"sourceIdentifier":"secalert_us@oracle.com","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"product":"Oracle Communications Unified Inventory Management","vendor":"Oracle Corporation","versions":[{"status":"affected","version":"7.5.0","versionType":"semver"},{"status":"affected","version":"7.5.1","versionType":"semver"},{"status":"affected","version":"7.6.0","versionType":"semver"},{"status":"affected","version":"7.7.0","versionType":"semver"},{"status":"affected","version":"7.8.0","versionType":"semver"},{"status":"affected","version":"8.0.1","versionType":"semver"}]}],"source":"secalert_us@oracle.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}],"id":"CVE-2026-101604","lastModified":"2026-11-12T19:16:45.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert_us@oracle.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-101604","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T15:56:57.016704Z","version":"2.0.3"}}]},"published":"2026-10-20T22:18:14.087","references":[{"source":"secalert_us@oracle.com","url":"https://www.oracle.com/security-alerts/cpuoct2026.html"}],"sourceIdentifier":"secalert_us@oracle.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102166.json b/data/2026/CVE-2026-102166.json index bad7fd89a5..eda0b61ede 100644 --- a/data/2026/CVE-2026-102166.json +++ b/data/2026/CVE-2026-102166.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Wi-Fi Access Points C-260","Wi-Fi Access Points C-250"],"product":"Wi-Fi Access Point","vendor":"Arista Networks","versions":[{"lessThan":"*","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue."}],"id":"CVE-2026-102166","lastModified":"2026-11-10T20:17:21.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:17:21.237","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Wi-Fi Access Points C-260","Wi-Fi Access Points C-250"],"product":"Wi-Fi Access Point","vendor":"Arista Networks","versions":[{"lessThan":"*","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue."}],"id":"CVE-2026-102166","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:17:21.237","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102339.json b/data/2026/CVE-2026-102339.json index 3bca80e6ff..ac21c5c992 100644 --- a/data/2026/CVE-2026-102339.json +++ b/data/2026/CVE-2026-102339.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"telepresence","vendor":"telepresenceio","versions":[{"status":"affected","version":"< 2.31.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0."}],"id":"CVE-2026-102339","lastModified":"2026-11-09T17:17:05.480","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102339","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:11:38.687798Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.500","references":[{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/pull/4217"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"telepresence","vendor":"telepresenceio","versions":[{"status":"affected","version":"< 2.31.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0."}],"id":"CVE-2026-102339","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102339","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:11:38.687798Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.500","references":[{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/pull/4217"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102340.json b/data/2026/CVE-2026-102340.json index 0b503e35c6..8576e5b9e1 100644 --- a/data/2026/CVE-2026-102340.json +++ b/data/2026/CVE-2026-102340.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"telepresence","vendor":"telepresenceio","versions":[{"status":"affected","version":"< 2.31.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist check, and CreateIntercept can target any managed namespace without checking the session's Kubernetes RBAC. An attacker operating any pod with network access to the manager can register in an arbitrary managed namespace, create service intercepts, receive intercepted traffic, and obtain the victim pod's complete container environment, including secrets, tokens, and API keys. The default cluster-wide deployment manages all namespaces. This vulnerability is fixed in 2.31.0."}],"id":"CVE-2026-102340","lastModified":"2026-11-09T17:17:05.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102340","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:09:24.840793Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.683","references":[{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/commit/04ec3464fe8878fdc96420cdc8036edefa0dc9ae"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/commit/6871235b674a6e843908d09696354c4b0f91578c"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/pull/4217"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/security/advisories/GHSA-j8j4-rw65-56r6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"telepresence","vendor":"telepresenceio","versions":[{"status":"affected","version":"< 2.31.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist check, and CreateIntercept can target any managed namespace without checking the session's Kubernetes RBAC. An attacker operating any pod with network access to the manager can register in an arbitrary managed namespace, create service intercepts, receive intercepted traffic, and obtain the victim pod's complete container environment, including secrets, tokens, and API keys. The default cluster-wide deployment manages all namespaces. This vulnerability is fixed in 2.31.0."}],"id":"CVE-2026-102340","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102340","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:09:24.840793Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.683","references":[{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/commit/04ec3464fe8878fdc96420cdc8036edefa0dc9ae"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/commit/6871235b674a6e843908d09696354c4b0f91578c"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/pull/4217"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0"},{"source":"security-advisories@github.com","url":"https://github.com/telepresenceio/telepresence/security/advisories/GHSA-j8j4-rw65-56r6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102589.json b/data/2026/CVE-2026-102589.json index d515c495c8..1253aee667 100644 --- a/data/2026/CVE-2026-102589.json +++ b/data/2026/CVE-2026-102589.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"12.3.11","status":"affected","version":"9.5.0","versionType":"semver"},{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"12.3.11","status":"affected","version":"9.5.0","versionType":"semver"},{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0."}],"id":"CVE-2026-102589","lastModified":"2026-11-11T15:17:12.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.5,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:12.447","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-102589"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-863"}],"source":"security@grafana.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"12.3.11","status":"affected","version":"9.5.0","versionType":"semver"},{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"12.3.11","status":"affected","version":"9.5.0","versionType":"semver"},{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0."}],"id":"CVE-2026-102589","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.5,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:12.447","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-102589"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-863"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102664.json b/data/2026/CVE-2026-102664.json index 8a315f503d..6fbcfa509b 100644 --- a/data/2026/CVE-2026-102664.json +++ b/data/2026/CVE-2026-102664.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"proxysql","vendor":"sysown","versions":[{"status":"affected","version":"< 3.0.10"},{"status":"affected","version":">= 3.1.0, < 3.1.10"},{"status":"affected","version":">= 4.0.0, < 4.0.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10."}],"id":"CVE-2026-102664","lastModified":"2026-11-09T17:17:05.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102664","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:09:27.461578Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:41.300","references":[{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/commit/396c742f7d50b1f479e1157e296ee9d0aff1b724"},{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/commit/a8c1cef4d44c4beea7f6aa21b8a09a7cb8c75520"},{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/releases/tag/v3.0.10"},{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/releases/tag/v3.1.10"},{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/releases/tag/v4.0.10"},{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/security/advisories/GHSA-fvch-fpgq-pwfx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"proxysql","vendor":"sysown","versions":[{"status":"affected","version":"< 3.0.10"},{"status":"affected","version":">= 3.1.0, < 3.1.10"},{"status":"affected","version":">= 4.0.0, < 4.0.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mysql_data_stream.cpp accepts a zlib stream when uncompress() returns Z_OK without checking that the actual output length equals the attacker-controlled payload_length. An authenticated MySQL client that negotiates compression can overstate payload_length, causing buffer2array() to parse the uninitialized tail of a heap buffer as MySQL packet headers and forward stale data to the backend. Backend error responses can disclose prior SQL queries, result data, credentials, or session state, and malformed lengths can also cause excessive allocations. This issue is fixed in versions 3.0.10, 3.1.10, and 4.0.10."}],"id":"CVE-2026-102664","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102664","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:09:27.461578Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:41.300","references":[{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/commit/396c742f7d50b1f479e1157e296ee9d0aff1b724"},{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/commit/a8c1cef4d44c4beea7f6aa21b8a09a7cb8c75520"},{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/releases/tag/v3.0.10"},{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/releases/tag/v3.1.10"},{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/releases/tag/v4.0.10"},{"source":"security-advisories@github.com","url":"https://github.com/sysown/proxysql/security/advisories/GHSA-fvch-fpgq-pwfx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102739.json b/data/2026/CVE-2026-102739.json index a498ff4c86..a0d1e714ca 100644 --- a/data/2026/CVE-2026-102739.json +++ b/data/2026/CVE-2026-102739.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"espectre","vendor":"francescopace","versions":[{"status":"affected","version":"< 3.0.0-rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with NumPy pickle support enabled through micro-espectre/tools/csi_utils.py and a direct loader. A malicious dataset contributor or pull-request author can place an object-typed array in a .npz file under micro-espectre/data, causing pickle-controlled code to execute as the maintainer or developer when a documented analysis tool accesses the field. This issue is fixed in version 3.0.0-rc1."}],"id":"CVE-2026-102739","lastModified":"2026-11-09T17:17:06.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:12:21.628543Z","version":"2.0.3"}}]},"published":"2026-11-05T17:17:32.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1"},{"source":"security-advisories@github.com","url":"https://github.com/francescopace/espectre/pull/154"},{"source":"security-advisories@github.com","url":"https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1"},{"source":"security-advisories@github.com","url":"https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"espectre","vendor":"francescopace","versions":[{"status":"affected","version":"< 3.0.0-rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with NumPy pickle support enabled through micro-espectre/tools/csi_utils.py and a direct loader. A malicious dataset contributor or pull-request author can place an object-typed array in a .npz file under micro-espectre/data, causing pickle-controlled code to execute as the maintainer or developer when a documented analysis tool accesses the field. This issue is fixed in version 3.0.0-rc1."}],"id":"CVE-2026-102739","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:12:21.628543Z","version":"2.0.3"}}]},"published":"2026-11-05T17:17:32.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/francescopace/espectre/commit/adf495ceed41840497347f0196ba4a6968fc4ee1"},{"source":"security-advisories@github.com","url":"https://github.com/francescopace/espectre/pull/154"},{"source":"security-advisories@github.com","url":"https://github.com/francescopace/espectre/releases/tag/3.0.0-rc1"},{"source":"security-advisories@github.com","url":"https://github.com/francescopace/espectre/security/advisories/GHSA-g96x-h6rg-cqq3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102803.json b/data/2026/CVE-2026-102803.json index 411b7be56f..7d5d471a9e 100644 --- a/data/2026/CVE-2026-102803.json +++ b/data/2026/CVE-2026-102803.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"J2Store extension for Joomla","vendor":"j2commerce.com","versions":[{"status":"affected","version":"6.0.0-6.6.5"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the \"New\" state."}],"id":"CVE-2026-102803","lastModified":"2026-11-10T17:17:18.350","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-10T17:17:18.350","references":[{"source":"security@joomla.org","url":"https://www.j2commerce.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"J2Store extension for Joomla","vendor":"j2commerce.com","versions":[{"status":"affected","version":"6.0.0-6.6.5"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the \"New\" state."}],"id":"CVE-2026-102803","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-10T17:17:18.350","references":[{"source":"security@joomla.org","url":"https://www.j2commerce.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-103863.json b/data/2026/CVE-2026-103863.json index 3ff96b4c02..147ee1c4d4 100644 --- a/data/2026/CVE-2026-103863.json +++ b/data/2026/CVE-2026-103863.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Sling Engine","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."}],"id":"CVE-2026-103863","lastModified":"2026-11-10T19:17:41.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103863","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:08:39.737532Z","version":"2.0.3"}}]},"published":"2026-11-05T13:17:06.880","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/05/6"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-693"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Sling Engine","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."}],"id":"CVE-2026-103863","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103863","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:08:39.737532Z","version":"2.0.3"}}]},"published":"2026-11-05T13:17:06.880","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/05/6"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-693"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103864.json b/data/2026/CVE-2026-103864.json index f846e77ae9..95f028c184 100644 --- a/data/2026/CVE-2026-103864.json +++ b/data/2026/CVE-2026-103864.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Sling Engine","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper output neutralization for logs in Apache Sling Engine.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."}],"id":"CVE-2026-103864","lastModified":"2026-11-10T19:17:41.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103864","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:10:43.110906Z","version":"2.0.3"}}]},"published":"2026-11-05T13:17:07.017","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/bchcm9xhz5zdqwykrdo4kw21j8gz6q55"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/05/7"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Sling Engine","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper output neutralization for logs in Apache Sling Engine.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."}],"id":"CVE-2026-103864","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103864","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:10:43.110906Z","version":"2.0.3"}}]},"published":"2026-11-05T13:17:07.017","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/bchcm9xhz5zdqwykrdo4kw21j8gz6q55"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/05/7"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103866.json b/data/2026/CVE-2026-103866.json index 13852c2031..1662cdbd02 100644 --- a/data/2026/CVE-2026-103866.json +++ b/data/2026/CVE-2026-103866.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Sling Engine","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."}],"id":"CVE-2026-103866","lastModified":"2026-11-10T16:17:13.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103866","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:55:18.133309Z","version":"2.0.3"}}]},"published":"2026-11-05T13:17:07.143","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/05/8"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"},{"lang":"en","value":"CWE-444"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Sling Engine","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."}],"id":"CVE-2026-103866","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103866","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:55:18.133309Z","version":"2.0.3"}}]},"published":"2026-11-05T13:17:07.143","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/05/8"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"},{"lang":"en","value":"CWE-444"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103906.json b/data/2026/CVE-2026-103906.json index 178ddc8b80..7d283865a1 100644 --- a/data/2026/CVE-2026-103906.json +++ b/data/2026/CVE-2026-103906.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["iOS","Android"],"product":"am_club","vendor":"am_automatic_machines","versions":[{"lessThan":"1.8.198","status":"affected","version":"1.7.194","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the MQTT broker and access data or perform actions across tenant boundaries."}],"id":"CVE-2026-103906","lastModified":"2026-11-09T18:17:18.663","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103906","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:22:39.420868Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:06.787","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://github.com/livieromarco/security-advisories/blob/main/advisories/CVE-2026-103906.md"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["iOS","Android"],"product":"am_club","vendor":"am_automatic_machines","versions":[{"lessThan":"1.8.198","status":"affected","version":"1.7.194","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the MQTT broker and access data or perform actions across tenant boundaries."}],"id":"CVE-2026-103906","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103906","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:22:39.420868Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:06.787","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://github.com/livieromarco/security-advisories/blob/main/advisories/CVE-2026-103906.md"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103984.json b/data/2026/CVE-2026-103984.json index 87d0346f88..ba2e80f963 100644 --- a/data/2026/CVE-2026-103984.json +++ b/data/2026/CVE-2026-103984.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"freescout","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.231"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231."}],"id":"CVE-2026-103984","lastModified":"2026-11-06T18:17:38.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103984","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:24:32.442823Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:10.710","references":[{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/commit/f0f8fd56253f1d7f42569ad30fb96375a473817a"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cr68-27qv-p5m4"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cr68-27qv-p5m4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"freescout","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.231"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231."}],"id":"CVE-2026-103984","lastModified":"2026-11-12T19:13:56.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103984","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:24:32.442823Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:10.710","references":[{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/commit/f0f8fd56253f1d7f42569ad30fb96375a473817a"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cr68-27qv-p5m4"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cr68-27qv-p5m4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103985.json b/data/2026/CVE-2026-103985.json index fbc3f7714a..e5342d857e 100644 --- a/data/2026/CVE-2026-103985.json +++ b/data/2026/CVE-2026-103985.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"freescout","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.231"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231."}],"id":"CVE-2026-103985","lastModified":"2026-11-06T18:17:38.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103985","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:46:36.800490Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:10.887","references":[{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/commit/83030464eec3c03712ad988b81f069b372c45399"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-m4hc-rc98-38jc"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-m4hc-rc98-38jc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-284"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"freescout","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.231"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231."}],"id":"CVE-2026-103985","lastModified":"2026-11-12T19:13:56.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103985","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:46:36.800490Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:10.887","references":[{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/commit/83030464eec3c03712ad988b81f069b372c45399"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-m4hc-rc98-38jc"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-m4hc-rc98-38jc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-284"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-104619.json b/data/2026/CVE-2026-104619.json index 2536ca60a1..c74195e8e1 100644 --- a/data/2026/CVE-2026-104619.json +++ b/data/2026/CVE-2026-104619.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["Zypp Backend"],"packageName":"PackageKit","product":"PackageKit","repo":"https://github.com/PackageKit/PackageKit/","vendor":"PackageKit","versions":[{"lessThan":"1.4.1","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation."}],"id":"CVE-2026-104619","lastModified":"2026-11-10T10:16:42.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-10T10:16:42.590","references":[{"source":"meissner@suse.de","url":"https://bugzilla.suse.com/show_bug.cgi?id=1284389"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1328"}],"source":"meissner@suse.de","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["Zypp Backend"],"packageName":"PackageKit","product":"PackageKit","repo":"https://github.com/PackageKit/PackageKit/","vendor":"PackageKit","versions":[{"lessThan":"1.4.1","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation."}],"id":"CVE-2026-104619","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"meissner@suse.de","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104619","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:44:11.486692Z","version":"2.0.3"}}]},"published":"2026-11-10T10:16:42.590","references":[{"source":"meissner@suse.de","url":"https://bugzilla.suse.com/show_bug.cgi?id=1284389"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1328"}],"source":"meissner@suse.de","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-104620.json b/data/2026/CVE-2026-104620.json index a26d8222e1..ccbbd232ab 100644 --- a/data/2026/CVE-2026-104620.json +++ b/data/2026/CVE-2026-104620.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["Zypp Backend"],"packageName":"PackageKit","product":"PackageKit","repo":"https://github.com/PackageKit/PackageKit","vendor":"PackageKit","versions":[{"lessThan":"1.4.1","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges."}],"id":"CVE-2026-104620","lastModified":"2026-11-10T05:17:41.193","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"meissner@suse.de","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-09T15:17:04.997","references":[{"source":"meissner@suse.de","url":"https://bugzilla.suse.com/show_bug.cgi?id=1284954"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"meissner@suse.de","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["Zypp Backend"],"packageName":"PackageKit","product":"PackageKit","repo":"https://github.com/PackageKit/PackageKit","vendor":"PackageKit","versions":[{"lessThan":"1.4.1","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges."}],"id":"CVE-2026-104620","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"meissner@suse.de","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-09T15:17:04.997","references":[{"source":"meissner@suse.de","url":"https://bugzilla.suse.com/show_bug.cgi?id=1284954"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"meissner@suse.de","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-104718.json b/data/2026/CVE-2026-104718.json index 229a18322c..351dfbbb93 100644 --- a/data/2026/CVE-2026-104718.json +++ b/data/2026/CVE-2026-104718.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Elementor Website Builder","vendor":"Unknown","versions":[{"lessThan":"4.3.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication."}],"id":"CVE-2026-104718","lastModified":"2026-11-11T12:18:15.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104718","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:43.484857Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.440","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/1a429b80-13ef-4cd3-a18a-eef834d7b865/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Elementor Website Builder","vendor":"Unknown","versions":[{"lessThan":"4.3.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication."}],"id":"CVE-2026-104718","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104718","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:43.484857Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.440","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/1a429b80-13ef-4cd3-a18a-eef834d7b865/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-104989.json b/data/2026/CVE-2026-104989.json index 6f4eda41de..def414e4d5 100644 --- a/data/2026/CVE-2026-104989.json +++ b/data/2026/CVE-2026-104989.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"V-Ray Swarm","vendor":"Chaos Software","versions":[{"lessThanOrEqual":"2.0.19","status":"affected","version":"0","versionType":"semver"}]}],"source":"mandiant-cve@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries"}],"id":"CVE-2026-104989","lastModified":"2026-11-09T18:17:19.433","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"mandiant-cve@google.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104989","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:21:41.103658Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:07.237","references":[{"source":"mandiant-cve@google.com","url":"https://documentation.chaos.com/space/VRAYSWARM/1430814721/2.0.21"},{"source":"mandiant-cve@google.com","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0043.md"}],"sourceIdentifier":"mandiant-cve@google.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"mandiant-cve@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"V-Ray Swarm","vendor":"Chaos Software","versions":[{"lessThanOrEqual":"2.0.19","status":"affected","version":"0","versionType":"semver"}]}],"source":"mandiant-cve@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries"}],"id":"CVE-2026-104989","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"mandiant-cve@google.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104989","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:21:41.103658Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:07.237","references":[{"source":"mandiant-cve@google.com","url":"https://documentation.chaos.com/space/VRAYSWARM/1430814721/2.0.21"},{"source":"mandiant-cve@google.com","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0043.md"}],"sourceIdentifier":"mandiant-cve@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"mandiant-cve@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105152.json b/data/2026/CVE-2026-105152.json index e554091b48..2bc28e854a 100644 --- a/data/2026/CVE-2026-105152.json +++ b/data/2026/CVE-2026-105152.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects."}],"id":"CVE-2026-105152","lastModified":"2026-11-11T13:17:12.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:12.790","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/199"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/v1zondkgmfoh3y83l0l191qthmstcm39"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects."}],"id":"CVE-2026-105152","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:12.790","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/199"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/v1zondkgmfoh3y83l0l191qthmstcm39"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-105153.json b/data/2026/CVE-2026-105153.json index 8a02f4b2bc..3cfb860bc1 100644 --- a/data/2026/CVE-2026-105153.json +++ b/data/2026/CVE-2026-105153.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a crafted Atom entry to the AtomPub endpoint. The entry body is parsed with a parser configuration that permits external parameter entities and external DTD subsets, and the parse happens before any per-weblog authorization check and before any check of whether the AtomPub feature is enabled, so the endpoint is reachable by any authenticated account on a default installation. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub entries with a hardened XML configuration and rejects AtomPub requests while the feature is disabled."}],"id":"CVE-2026-105153","lastModified":"2026-11-11T13:17:12.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:12.957","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/198"},{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/201"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/w7dsz19261myrcwx8ssbwr67hc1wfosj"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a crafted Atom entry to the AtomPub endpoint. The entry body is parsed with a parser configuration that permits external parameter entities and external DTD subsets, and the parse happens before any per-weblog authorization check and before any check of whether the AtomPub feature is enabled, so the endpoint is reachable by any authenticated account on a default installation. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub entries with a hardened XML configuration and rejects AtomPub requests while the feature is disabled."}],"id":"CVE-2026-105153","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:12.957","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/198"},{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/201"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/w7dsz19261myrcwx8ssbwr67hc1wfosj"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-105154.json b/data/2026/CVE-2026-105154.json index ef096b4aa4..08e57478bd 100644 --- a/data/2026/CVE-2026-105154.json +++ b/data/2026/CVE-2026-105154.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a crafted web page. The action that adds a Planet subscription can be triggered cross-site; in recent releases it accepts GET requests, which Roller's CSRF token check does not cover. The action fetches the supplied URL and saves the subscription, and any fetched content that parses as a feed is then published without authentication in the aggregated Planet feed. The Planet aggregator is enabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST requests with a valid CSRF token for Planet administration changes and turns the Planet aggregator off by default."}],"id":"CVE-2026-105154","lastModified":"2026-11-11T13:17:13.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:13.127","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/200"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/kj131jvv6y30o6q89shw6f4g4s4q5hw2"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a crafted web page. The action that adds a Planet subscription can be triggered cross-site; in recent releases it accepts GET requests, which Roller's CSRF token check does not cover. The action fetches the supplied URL and saves the subscription, and any fetched content that parses as a feed is then published without authentication in the aggregated Planet feed. The Planet aggregator is enabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST requests with a valid CSRF token for Planet administration changes and turns the Planet aggregator off by default."}],"id":"CVE-2026-105154","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:13.127","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/200"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/kj131jvv6y30o6q89shw6f4g4s4q5hw2"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-105425.json b/data/2026/CVE-2026-105425.json index 3888e5d52b..c795c7d186 100644 --- a/data/2026/CVE-2026-105425.json +++ b/data/2026/CVE-2026-105425.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3","versionType":"custom"},{"status":"unaffected","version":"10.7.4","versionType":"custom"}]},{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution."}],"id":"CVE-2026-105425","lastModified":"2026-11-11T11:17:09.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105425","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:19.173484Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:13.410","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"},{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3","versionType":"custom"},{"status":"unaffected","version":"10.7.4","versionType":"custom"}]},{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution."}],"id":"CVE-2026-105425","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105425","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:19.173484Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:13.410","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"},{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105426.json b/data/2026/CVE-2026-105426.json index 1307049982..aba8870091 100644 --- a/data/2026/CVE-2026-105426.json +++ b/data/2026/CVE-2026-105426.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root."}],"id":"CVE-2026-105426","lastModified":"2026-11-11T05:19:16.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.5,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105426","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T16:17:13.557","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root."}],"id":"CVE-2026-105426","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.5,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105426","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T16:17:13.557","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105427.json b/data/2026/CVE-2026-105427.json index 9b93cd6a39..83e6c49900 100644 --- a/data/2026/CVE-2026-105427.json +++ b/data/2026/CVE-2026-105427.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service."}],"id":"CVE-2026-105427","lastModified":"2026-11-10T18:17:18.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:13.683","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service."}],"id":"CVE-2026-105427","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:13.683","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105437.json b/data/2026/CVE-2026-105437.json index f5de8f84c7..58677da79b 100644 --- a/data/2026/CVE-2026-105437.json +++ b/data/2026/CVE-2026-105437.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"lessThan":"2.49.1","status":"affected","version":"0","versionType":"semver"},{"lessThan":"2.50.2","status":"affected","version":"2.50.0-rc0","versionType":"semver"},{"lessThan":"2.51.3","status":"affected","version":"2.51.0-rc0","versionType":"semver"},{"lessThan":"2.52.1","status":"affected","version":"2.52.0-rc0","versionType":"semver"},{"lessThan":"2.53.1","status":"affected","version":"2.53.0-rc0","versionType":"semver"},{"lessThan":"2.54.1","status":"affected","version":"2.54.0-rc0","versionType":"semver"},{"lessThan":"2.55.1","status":"affected","version":"2.55.0-rc0","versionType":"semver"},{"lessThan":"2.56.1","status":"affected","version":"2.56.0-rc0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}],"id":"CVE-2026-105437","lastModified":"2026-11-10T19:17:46.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-10T19:17:46.200","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/814"},{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/632121"},{"source":"cve@gitlab.com","url":"https://hackerone.com/reports/4044249"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"lessThan":"2.49.1","status":"affected","version":"0","versionType":"semver"},{"lessThan":"2.50.2","status":"affected","version":"2.50.0-rc0","versionType":"semver"},{"lessThan":"2.51.3","status":"affected","version":"2.51.0-rc0","versionType":"semver"},{"lessThan":"2.52.1","status":"affected","version":"2.52.0-rc0","versionType":"semver"},{"lessThan":"2.53.1","status":"affected","version":"2.53.0-rc0","versionType":"semver"},{"lessThan":"2.54.1","status":"affected","version":"2.54.0-rc0","versionType":"semver"},{"lessThan":"2.55.1","status":"affected","version":"2.55.0-rc0","versionType":"semver"},{"lessThan":"2.56.1","status":"affected","version":"2.56.0-rc0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}],"id":"CVE-2026-105437","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-10T19:17:46.200","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/814"},{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/632121"},{"source":"cve@gitlab.com","url":"https://hackerone.com/reports/4044249"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-105440.json b/data/2026/CVE-2026-105440.json index 1309dc6541..f3c5515043 100644 --- a/data/2026/CVE-2026-105440.json +++ b/data/2026/CVE-2026-105440.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Switch Engine (EXOS)","vendor":"Extreme Networks","versions":[{"lessThan":"33.7.1-patch1-11","status":"affected","version":"33.7.0","versionType":"custom"},{"lessThan":"33.1.100-patch1-9","status":"affected","version":"33.1.0","versionType":"custom"},{"lessThan":"32.7.4.15-patch1-11","status":"affected","version":"32.0.0","versionType":"custom"}]}],"source":"1c053176-eef3-4d6a-ae0b-24728c86587b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in the JSON-RPC web services interface\nof Extreme Networks Switch Engine (EXOS) allows an authenticated,\nlow-privileged (read-only) user to execute CLI show commands that are\nrestricted to that role through the command line interface. Successful\nexploitation results in disclosure of sensitive information, including the\ndevice configuration and the password hashes of local accounts. Configuration,\nenable, and debug commands are not affected. Disclosed password hashes can be\nattacked offline, and a weak password could lead to administrative access to\nthe device. This issue is fixed in Switch Engine 33.7.1-patch1-11,\n33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.\n\n\n\n\n\n\n\n\nExtreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure."}],"id":"CVE-2026-105440","lastModified":"2026-11-11T16:17:24.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"1c053176-eef3-4d6a-ae0b-24728c86587b","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"1c053176-eef3-4d6a-ae0b-24728c86587b","type":"Secondary"}]},"published":"2026-11-11T16:17:24.817","references":[{"source":"1c053176-eef3-4d6a-ae0b-24728c86587b","url":"https://extreme-networks.my.site.com/ExtrArticleDetail?an=000140004"}],"sourceIdentifier":"1c053176-eef3-4d6a-ae0b-24728c86587b","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"1c053176-eef3-4d6a-ae0b-24728c86587b","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Switch Engine (EXOS)","vendor":"Extreme Networks","versions":[{"lessThan":"33.7.1-patch1-11","status":"affected","version":"33.7.0","versionType":"custom"},{"lessThan":"33.1.100-patch1-9","status":"affected","version":"33.1.0","versionType":"custom"},{"lessThan":"32.7.4.15-patch1-11","status":"affected","version":"32.0.0","versionType":"custom"}]}],"source":"1c053176-eef3-4d6a-ae0b-24728c86587b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in the JSON-RPC web services interface\nof Extreme Networks Switch Engine (EXOS) allows an authenticated,\nlow-privileged (read-only) user to execute CLI show commands that are\nrestricted to that role through the command line interface. Successful\nexploitation results in disclosure of sensitive information, including the\ndevice configuration and the password hashes of local accounts. Configuration,\nenable, and debug commands are not affected. Disclosed password hashes can be\nattacked offline, and a weak password could lead to administrative access to\nthe device. This issue is fixed in Switch Engine 33.7.1-patch1-11,\n33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.\n\n\n\n\n\n\n\n\nExtreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure."}],"id":"CVE-2026-105440","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"1c053176-eef3-4d6a-ae0b-24728c86587b","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"1c053176-eef3-4d6a-ae0b-24728c86587b","type":"Secondary"}]},"published":"2026-11-11T16:17:24.817","references":[{"source":"1c053176-eef3-4d6a-ae0b-24728c86587b","url":"https://extreme-networks.my.site.com/ExtrArticleDetail?an=000140004"}],"sourceIdentifier":"1c053176-eef3-4d6a-ae0b-24728c86587b","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"1c053176-eef3-4d6a-ae0b-24728c86587b","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105515.json b/data/2026/CVE-2026-105515.json index f8eb5c1dd5..684daec288 100644 --- a/data/2026/CVE-2026-105515.json +++ b/data/2026/CVE-2026-105515.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in Windows Message Queuing allows an unauthorized attacker to deny service over a network."}],"id":"CVE-2026-105515","lastModified":"2026-11-10T21:17:41.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105515","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:10:35.239809Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:50.740","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105515"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in Windows Message Queuing allows an unauthorized attacker to deny service over a network."}],"id":"CVE-2026-105515","lastModified":"2026-11-10T21:17:41.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105515","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:10:35.239809Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:50.740","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105515"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105518.json b/data/2026/CVE-2026-105518.json index 5496f89d99..4d5b7b17e0 100644 --- a/data/2026/CVE-2026-105518.json +++ b/data/2026/CVE-2026-105518.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-105518","lastModified":"2026-11-10T21:17:41.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105518","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:10:24.171568Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:50.957","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105518"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-105518","lastModified":"2026-11-10T21:17:41.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105518","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:10:24.171568Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:50.957","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105518"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105520.json b/data/2026/CVE-2026-105520.json index 9379fb72d1..158b267855 100644 --- a/data/2026/CVE-2026-105520.json +++ b/data/2026/CVE-2026-105520.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper link resolution before file access ('link following') in Windows DNS allows an authorized attacker to elevate privileges over a network."}],"id":"CVE-2026-105520","lastModified":"2026-11-10T21:17:41.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105520","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:10:11.354752Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:51.160","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105520"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper link resolution before file access ('link following') in Windows DNS allows an authorized attacker to elevate privileges over a network."}],"id":"CVE-2026-105520","lastModified":"2026-11-10T21:17:41.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105520","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:10:11.354752Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:51.160","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105520"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105522.json b/data/2026/CVE-2026-105522.json index 564ab005b3..6ff19ed8d9 100644 --- a/data/2026/CVE-2026-105522.json +++ b/data/2026/CVE-2026-105522.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Winlogon allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105522","lastModified":"2026-11-10T21:17:42.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:09:58.186649Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:51.310","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105522"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Winlogon allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105522","lastModified":"2026-11-10T21:17:42.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:09:58.186649Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:51.310","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105522"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105524.json b/data/2026/CVE-2026-105524.json index d04a5269f7..dc08257fff 100644 --- a/data/2026/CVE-2026-105524.json +++ b/data/2026/CVE-2026-105524.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105524","lastModified":"2026-11-10T21:17:42.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:09:45.706838Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:51.487","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105524"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105524","lastModified":"2026-11-10T21:17:42.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:09:45.706838Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:51.487","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105524"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105525.json b/data/2026/CVE-2026-105525.json index d1d4878ef6..a3eb2a63c6 100644 --- a/data/2026/CVE-2026-105525.json +++ b/data/2026/CVE-2026-105525.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105525","lastModified":"2026-11-10T21:17:42.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:09:32.590936Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:51.693","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105525"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105525","lastModified":"2026-11-10T21:17:42.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:09:32.590936Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:51.693","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105525"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105526.json b/data/2026/CVE-2026-105526.json index d08c405559..75f3e5dd14 100644 --- a/data/2026/CVE-2026-105526.json +++ b/data/2026/CVE-2026-105526.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Double free in Winsock allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105526","lastModified":"2026-11-10T21:17:42.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:09:21.140561Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:51.890","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105526"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Double free in Winsock allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105526","lastModified":"2026-11-10T21:17:42.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:09:21.140561Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:51.890","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105526"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105527.json b/data/2026/CVE-2026-105527.json index 01cbcf99e9..ee9bd16c73 100644 --- a/data/2026/CVE-2026-105527.json +++ b/data/2026/CVE-2026-105527.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted pointer dereference in Windows Encrypting File System (EFS) allows an authorized attacker to deny service locally."}],"id":"CVE-2026-105527","lastModified":"2026-11-10T21:17:42.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:09:08.493320Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:52.090","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105527"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted pointer dereference in Windows Encrypting File System (EFS) allows an authorized attacker to deny service locally."}],"id":"CVE-2026-105527","lastModified":"2026-11-10T21:17:42.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:09:08.493320Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:52.090","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105527"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105528.json b/data/2026/CVE-2026-105528.json index 22d91f11b7..3ec48c29ff 100644 --- a/data/2026/CVE-2026-105528.json +++ b/data/2026/CVE-2026-105528.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105528","lastModified":"2026-11-10T21:17:42.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:08:56.130728Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:52.357","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105528"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105528","lastModified":"2026-11-10T21:17:42.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:08:56.130728Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:52.357","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105528"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105529.json b/data/2026/CVE-2026-105529.json index dbf2a53c61..5887c1505a 100644 --- a/data/2026/CVE-2026-105529.json +++ b/data/2026/CVE-2026-105529.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak authentication in Windows Storage allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105529","lastModified":"2026-11-10T21:17:42.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:08:43.657328Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:52.573","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105529"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak authentication in Windows Storage allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105529","lastModified":"2026-11-10T21:17:42.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:08:43.657328Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:52.573","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105529"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105530.json b/data/2026/CVE-2026-105530.json index 4d297dba9f..f4e217de22 100644 --- a/data/2026/CVE-2026-105530.json +++ b/data/2026/CVE-2026-105530.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows System Events Broker allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-105530","lastModified":"2026-11-10T21:17:43.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:08:32.146202Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:52.823","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105530"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows System Events Broker allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-105530","lastModified":"2026-11-10T21:17:43.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:08:32.146202Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:52.823","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105530"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105531.json b/data/2026/CVE-2026-105531.json index 6a6e3dcaf5..4c6e7cf276 100644 --- a/data/2026/CVE-2026-105531.json +++ b/data/2026/CVE-2026-105531.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"External control of file name or path in Windows Print Spooler Components allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-105531","lastModified":"2026-11-10T21:17:43.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:08:20.336479Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:53.193","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105531"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"External control of file name or path in Windows Print Spooler Components allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-105531","lastModified":"2026-11-10T21:17:43.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:08:20.336479Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:53.193","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105531"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105532.json b/data/2026/CVE-2026-105532.json index 3a16784ede..43fa379b26 100644 --- a/data/2026/CVE-2026-105532.json +++ b/data/2026/CVE-2026-105532.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105532","lastModified":"2026-11-10T21:17:43.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105532","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:08:09.307932Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:53.513","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105532"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105532","lastModified":"2026-11-10T21:17:43.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105532","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:08:09.307932Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:53.513","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105532"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105533.json b/data/2026/CVE-2026-105533.json index ec2a64cb75..97605b9a53 100644 --- a/data/2026/CVE-2026-105533.json +++ b/data/2026/CVE-2026-105533.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Release of invalid pointer or reference in Windows COM allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105533","lastModified":"2026-11-10T21:17:43.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105533","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:07:57.322453Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:53.923","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105533"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Release of invalid pointer or reference in Windows COM allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105533","lastModified":"2026-11-10T21:17:43.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105533","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:07:57.322453Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:53.923","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105533"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105534.json b/data/2026/CVE-2026-105534.json index f37677bf27..3265da0bba 100644 --- a/data/2026/CVE-2026-105534.json +++ b/data/2026/CVE-2026-105534.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Storage allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-105534","lastModified":"2026-11-10T21:17:43.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105534","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:07:45.490872Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:54.677","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105534"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Storage allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-105534","lastModified":"2026-11-10T21:17:43.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105534","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:07:45.490872Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:54.677","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105534"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105537.json b/data/2026/CVE-2026-105537.json index c2649e2fb4..591b84cc9b 100644 --- a/data/2026/CVE-2026-105537.json +++ b/data/2026/CVE-2026-105537.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized resource in Mailslot File System allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-105537","lastModified":"2026-11-10T21:17:43.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105537","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:07:32.493330Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:55.390","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105537"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized resource in Mailslot File System allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-105537","lastModified":"2026-11-10T21:17:43.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105537","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:07:32.493330Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:55.390","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105537"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105540.json b/data/2026/CVE-2026-105540.json index d82f7948bf..e271f5ca4e 100644 --- a/data/2026/CVE-2026-105540.json +++ b/data/2026/CVE-2026-105540.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect resource transfer between spheres in Windows Error Reporting allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105540","lastModified":"2026-11-10T21:17:44.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105540","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:06:55.052639Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:55.580","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105540"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-669"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect resource transfer between spheres in Windows Error Reporting allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105540","lastModified":"2026-11-10T21:17:44.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105540","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:06:55.052639Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:55.580","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105540"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-669"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105541.json b/data/2026/CVE-2026-105541.json index a81191f624..940e855ce3 100644 --- a/data/2026/CVE-2026-105541.json +++ b/data/2026/CVE-2026-105541.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of out-of-range pointer offset in Windows Audio Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105541","lastModified":"2026-11-10T21:17:44.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:06:43.356641Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:55.770","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105541"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-823"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of out-of-range pointer offset in Windows Audio Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105541","lastModified":"2026-11-10T21:17:44.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:06:43.356641Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:55.770","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105541"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-823"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105542.json b/data/2026/CVE-2026-105542.json index 276f43016c..186f9cbd52 100644 --- a/data/2026/CVE-2026-105542.json +++ b/data/2026/CVE-2026-105542.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted pointer dereference in Windows NTFS allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-105542","lastModified":"2026-11-10T21:17:44.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:06:30.750754Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:55.947","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105542"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted pointer dereference in Windows NTFS allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-105542","lastModified":"2026-11-10T21:17:44.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:06:30.750754Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:55.947","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105542"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105543.json b/data/2026/CVE-2026-105543.json index 76a3f8fc4a..4062c70390 100644 --- a/data/2026/CVE-2026-105543.json +++ b/data/2026/CVE-2026-105543.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105543","lastModified":"2026-11-10T21:17:44.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:06:17.838774Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:56.130","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105543"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105543","lastModified":"2026-11-10T21:17:44.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:06:17.838774Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:56.130","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105543"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105545.json b/data/2026/CVE-2026-105545.json index eda81a5fa7..c58fd8a0bd 100644 --- a/data/2026/CVE-2026-105545.json +++ b/data/2026/CVE-2026-105545.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7807","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7807","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9711","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9711","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3231","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9711","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5761","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.\nA locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\nThe security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation."}],"id":"CVE-2026-105545","lastModified":"2026-11-10T21:17:44.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:05:52.846833Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:56.503","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105545"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7807","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7807","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9711","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9711","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3231","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9711","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5761","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.\nA locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\nThe security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation."}],"id":"CVE-2026-105545","lastModified":"2026-11-10T21:17:44.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:05:52.846833Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:56.503","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105545"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105546.json b/data/2026/CVE-2026-105546.json index 47e3aa541e..9e8ffa9d9f 100644 --- a/data/2026/CVE-2026-105546.json +++ b/data/2026/CVE-2026-105546.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105546","lastModified":"2026-11-10T21:17:45.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:05:40.782776Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:56.710","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105546"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105546","lastModified":"2026-11-10T21:17:45.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:05:40.782776Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:56.710","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105546"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105547.json b/data/2026/CVE-2026-105547.json index 1d882e6f7a..44df921277 100644 --- a/data/2026/CVE-2026-105547.json +++ b/data/2026/CVE-2026-105547.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Double free in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105547","lastModified":"2026-11-10T21:17:45.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:05:26.629776Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:56.900","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105547"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Double free in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105547","lastModified":"2026-11-10T21:17:45.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:05:26.629776Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:56.900","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105547"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105549.json b/data/2026/CVE-2026-105549.json index fc5ee20889..be2c6bfcd5 100644 --- a/data/2026/CVE-2026-105549.json +++ b/data/2026/CVE-2026-105549.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows Smart Card allows an authorized attacker to disclose information with a physical attack."}],"id":"CVE-2026-105549","lastModified":"2026-11-10T21:17:45.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105549","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:05:14.358193Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:57.107","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105549"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows Smart Card allows an authorized attacker to disclose information with a physical attack."}],"id":"CVE-2026-105549","lastModified":"2026-11-10T21:17:45.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105549","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:05:14.358193Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:57.107","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105549"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105554.json b/data/2026/CVE-2026-105554.json index 53f3c29acb..2269ab2e67 100644 --- a/data/2026/CVE-2026-105554.json +++ b/data/2026/CVE-2026-105554.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105554","lastModified":"2026-11-10T21:17:46.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:04:22.885556Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:57.863","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105554"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105554","lastModified":"2026-11-10T21:17:46.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:04:22.885556Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:57.863","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105554"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105557.json b/data/2026/CVE-2026-105557.json index c13f859c38..83e4239f38 100644 --- a/data/2026/CVE-2026-105557.json +++ b/data/2026/CVE-2026-105557.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of sensitive system information to an unauthorized control sphere in Windows DHCP Server allows an unauthorized attacker to disclose information over a network."}],"id":"CVE-2026-105557","lastModified":"2026-11-10T21:17:46.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105557","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:04:10.618767Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.053","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105557"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of sensitive system information to an unauthorized control sphere in Windows DHCP Server allows an unauthorized attacker to disclose information over a network."}],"id":"CVE-2026-105557","lastModified":"2026-11-10T21:17:46.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105557","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:04:10.618767Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.053","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105557"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105558.json b/data/2026/CVE-2026-105558.json index 07a2791235..d1060610eb 100644 --- a/data/2026/CVE-2026-105558.json +++ b/data/2026/CVE-2026-105558.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code over a network."}],"id":"CVE-2026-105558","lastModified":"2026-11-10T21:17:46.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:03:57.238007Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.203","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105558"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code over a network."}],"id":"CVE-2026-105558","lastModified":"2026-11-10T21:17:46.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:03:57.238007Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.203","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105558"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105559.json b/data/2026/CVE-2026-105559.json index d3e8679376..5dcc364bbf 100644 --- a/data/2026/CVE-2026-105559.json +++ b/data/2026/CVE-2026-105559.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"No cwe for this issue in Windows Active Directory allows an authorized attacker to deny service over a network."}],"id":"CVE-2026-105559","lastModified":"2026-11-10T21:17:46.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:03:44.035649Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.380","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105559"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"No cwe for this issue in Windows Active Directory allows an authorized attacker to deny service over a network."}],"id":"CVE-2026-105559","lastModified":"2026-11-10T21:17:46.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:03:44.035649Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.380","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105559"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105560.json b/data/2026/CVE-2026-105560.json index d3282ebb00..917da84edf 100644 --- a/data/2026/CVE-2026-105560.json +++ b/data/2026/CVE-2026-105560.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Release of invalid pointer or reference in Windows DHCP Server allows an authorized attacker to execute code over a network."}],"id":"CVE-2026-105560","lastModified":"2026-11-10T21:17:46.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:03:30.508323Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.580","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105560"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Release of invalid pointer or reference in Windows DHCP Server allows an authorized attacker to execute code over a network."}],"id":"CVE-2026-105560","lastModified":"2026-11-10T21:17:46.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:03:30.508323Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.580","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105560"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105561.json b/data/2026/CVE-2026-105561.json index 886d4567aa..5100a2449b 100644 --- a/data/2026/CVE-2026-105561.json +++ b/data/2026/CVE-2026-105561.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled resource consumption in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to deny service over a network."}],"id":"CVE-2026-105561","lastModified":"2026-11-10T21:17:46.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105561","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:03:17.546707Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.740","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105561"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled resource consumption in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to deny service over a network."}],"id":"CVE-2026-105561","lastModified":"2026-11-10T21:17:46.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105561","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:03:17.546707Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.740","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105561"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105562.json b/data/2026/CVE-2026-105562.json index 62d0f30d36..3eff0223e0 100644 --- a/data/2026/CVE-2026-105562.json +++ b/data/2026/CVE-2026-105562.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Time-of-check time-of-use (toctou) race condition in Windows Container Manager Service allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-105562","lastModified":"2026-11-10T21:17:46.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:03:04.794123Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.937","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105562"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Time-of-check time-of-use (toctou) race condition in Windows Container Manager Service allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-105562","lastModified":"2026-11-10T21:17:46.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:03:04.794123Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:58.937","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105562"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105565.json b/data/2026/CVE-2026-105565.json index d6080a905b..8dcc3138f6 100644 --- a/data/2026/CVE-2026-105565.json +++ b/data/2026/CVE-2026-105565.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105565","lastModified":"2026-11-10T21:17:47.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105565","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:02:50.742821Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:59.087","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105565"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105565","lastModified":"2026-11-10T21:17:47.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105565","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:02:50.742821Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:59.087","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105565"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105566.json b/data/2026/CVE-2026-105566.json index 2ff6afbfa5..43f8403404 100644 --- a/data/2026/CVE-2026-105566.json +++ b/data/2026/CVE-2026-105566.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105566","lastModified":"2026-11-10T21:17:47.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105566","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:02:38.330683Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:59.237","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105566"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105566","lastModified":"2026-11-10T21:17:47.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105566","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:02:38.330683Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:59.237","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105566"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105567.json b/data/2026/CVE-2026-105567.json index ec49884474..f647306835 100644 --- a/data/2026/CVE-2026-105567.json +++ b/data/2026/CVE-2026-105567.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105567","lastModified":"2026-11-10T21:17:47.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105567","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:02:25.747293Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:59.430","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105567"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105567","lastModified":"2026-11-10T21:17:47.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105567","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:02:25.747293Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:59.430","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105567"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105568.json b/data/2026/CVE-2026-105568.json index 1401f4b914..d1bece9144 100644 --- a/data/2026/CVE-2026-105568.json +++ b/data/2026/CVE-2026-105568.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network."}],"id":"CVE-2026-105568","lastModified":"2026-11-10T21:17:47.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:02:13.928452Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:59.587","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105568"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network."}],"id":"CVE-2026-105568","lastModified":"2026-11-10T21:17:47.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:02:13.928452Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:59.587","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105568"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105574.json b/data/2026/CVE-2026-105574.json index bd49bdddb6..028dce6cf5 100644 --- a/data/2026/CVE-2026-105574.json +++ b/data/2026/CVE-2026-105574.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105574","lastModified":"2026-11-10T21:17:47.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:01:48.086821Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:59.970","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105574"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105574","lastModified":"2026-11-10T21:17:47.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:01:48.086821Z","version":"2.0.3"}}]},"published":"2026-11-10T19:17:59.970","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105574"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105575.json b/data/2026/CVE-2026-105575.json index bfb0877f8b..5a58b7996f 100644 --- a/data/2026/CVE-2026-105575.json +++ b/data/2026/CVE-2026-105575.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105575","lastModified":"2026-11-10T21:17:47.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:01:36.736577Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:00.113","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105575"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105575","lastModified":"2026-11-10T21:17:47.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:01:36.736577Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:00.113","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105575"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105578.json b/data/2026/CVE-2026-105578.json index a73ae8bc3a..069ce8f2af 100644 --- a/data/2026/CVE-2026-105578.json +++ b/data/2026/CVE-2026-105578.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-105578","lastModified":"2026-11-10T21:17:48.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105578","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:01:24.664185Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:00.303","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105578"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-105578","lastModified":"2026-11-10T21:17:48.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105578","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:01:24.664185Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:00.303","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105578"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105579.json b/data/2026/CVE-2026-105579.json index 121b105f9e..6a9613736d 100644 --- a/data/2026/CVE-2026-105579.json +++ b/data/2026/CVE-2026-105579.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network."}],"id":"CVE-2026-105579","lastModified":"2026-11-10T21:17:48.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105579","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:01:12.067634Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:00.503","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105579"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to disclose information over a network."}],"id":"CVE-2026-105579","lastModified":"2026-11-10T21:17:48.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105579","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:01:12.067634Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:00.503","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105579"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105580.json b/data/2026/CVE-2026-105580.json index 53cb1d85bf..1938b91bf0 100644 --- a/data/2026/CVE-2026-105580.json +++ b/data/2026/CVE-2026-105580.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Management Instrumentation allows an unauthorized attacker to execute code locally."}],"id":"CVE-2026-105580","lastModified":"2026-11-10T21:17:48.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:00:59.744565Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:00.650","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105580"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Management Instrumentation allows an unauthorized attacker to execute code locally."}],"id":"CVE-2026-105580","lastModified":"2026-11-10T21:17:48.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:00:59.744565Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:00.650","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105580"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105581.json b/data/2026/CVE-2026-105581.json index c17995ed52..6f224fc9ec 100644 --- a/data/2026/CVE-2026-105581.json +++ b/data/2026/CVE-2026-105581.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105581","lastModified":"2026-11-10T21:17:48.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:00:48.109393Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:00.837","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105581"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105581","lastModified":"2026-11-10T21:17:48.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:00:48.109393Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:00.837","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105581"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105587.json b/data/2026/CVE-2026-105587.json index 93f77de55c..24df1cf3cc 100644 --- a/data/2026/CVE-2026-105587.json +++ b/data/2026/CVE-2026-105587.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows OLE DB allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105587","lastModified":"2026-11-10T21:17:49.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:59:49.487207Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:01.710","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105587"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows OLE DB allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105587","lastModified":"2026-11-10T21:17:49.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:59:49.487207Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:01.710","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105587"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105588.json b/data/2026/CVE-2026-105588.json index 4bd50a6f73..1b253313a2 100644 --- a/data/2026/CVE-2026-105588.json +++ b/data/2026/CVE-2026-105588.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105588","lastModified":"2026-11-10T21:17:49.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:59:38.252791Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:01.910","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105588"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105588","lastModified":"2026-11-10T21:17:49.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:59:38.252791Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:01.910","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105588"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105589.json b/data/2026/CVE-2026-105589.json index 5624fa50a2..c8de77969c 100644 --- a/data/2026/CVE-2026-105589.json +++ b/data/2026/CVE-2026-105589.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Wireless Networking allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105589","lastModified":"2026-11-10T21:17:49.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:59:26.758713Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:02.070","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105589"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Wireless Networking allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105589","lastModified":"2026-11-10T21:17:49.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:59:26.758713Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:02.070","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105589"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105590.json b/data/2026/CVE-2026-105590.json index 0913983aca..a9302f30e0 100644 --- a/data/2026/CVE-2026-105590.json +++ b/data/2026/CVE-2026-105590.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper certificate validation in Windows Active Directory Certificate Services allows an authorized attacker to bypass a security feature over a network."}],"id":"CVE-2026-105590","lastModified":"2026-11-10T21:17:50.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:59:14.753833Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:02.257","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105590"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper certificate validation in Windows Active Directory Certificate Services allows an authorized attacker to bypass a security feature over a network."}],"id":"CVE-2026-105590","lastModified":"2026-11-10T21:17:50.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:59:14.753833Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:02.257","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105590"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105669.json b/data/2026/CVE-2026-105669.json index 43f83bfcb3..fb3d7a2b02 100644 --- a/data/2026/CVE-2026-105669.json +++ b/data/2026/CVE-2026-105669.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3","versionType":"custom"},{"status":"unaffected","version":"10.7.4","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries."}],"id":"CVE-2026-105669","lastModified":"2026-11-10T18:17:18.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.5,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:13.810","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3","versionType":"custom"},{"status":"unaffected","version":"10.7.4","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries."}],"id":"CVE-2026-105669","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.5,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:13.810","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105734.json b/data/2026/CVE-2026-105734.json index 18c85abd73..00969c3d7f 100644 --- a/data/2026/CVE-2026-105734.json +++ b/data/2026/CVE-2026-105734.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["Azure Linux 3.0"],"product":"Azure Local","vendor":"Microsoft","versions":[{"lessThan":"1.2610.2.3134","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105734","lastModified":"2026-11-10T21:17:52.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105734","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:58:52.000843Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:02.433","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105734"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["Azure Linux 3.0"],"product":"Azure Local","vendor":"Microsoft","versions":[{"lessThan":"1.2610.2.3134","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-105734","lastModified":"2026-11-10T21:17:52.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105734","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:58:52.000843Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:02.433","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105734"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105813.json b/data/2026/CVE-2026-105813.json index cb80a11487..5a08115007 100644 --- a/data/2026/CVE-2026-105813.json +++ b/data/2026/CVE-2026-105813.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"User Workspace Manager","vendor":"Ivanti","versions":[{"status":"unaffected","version":"2026.4"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token."}],"id":"CVE-2026-105813","lastModified":"2026-11-10T16:17:13.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.0,"impactScore":3.7,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:13.930","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-User-Workspace-Manager-CVE-2026-105813?language=en_US"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"User Workspace Manager","vendor":"Ivanti","versions":[{"status":"unaffected","version":"2026.4"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token."}],"id":"CVE-2026-105813","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.0,"impactScore":3.7,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:13.930","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-User-Workspace-Manager-CVE-2026-105813?language=en_US"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Primary"}]} diff --git a/data/2026/CVE-2026-105948.json b/data/2026/CVE-2026-105948.json index 2bfffa6bfc..fe4fc4bf71 100644 --- a/data/2026/CVE-2026-105948.json +++ b/data/2026/CVE-2026-105948.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13487","status":"affected","version":"2024.2.5035","versionType":"custom"},{"lessThan":"2026.3.15909","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled."}],"id":"CVE-2026-105948","lastModified":"2026-11-11T08:17:16.740","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.740","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-21"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@octopus.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13487","status":"affected","version":"2024.2.5035","versionType":"custom"},{"lessThan":"2026.3.15909","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue affects instances using LDAP authentication with self-service login editing enabled."}],"id":"CVE-2026-105948","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.740","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-21"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@octopus.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105986.json b/data/2026/CVE-2026-105986.json index e1c5e88a94..3d8aae89a3 100644 --- a/data/2026/CVE-2026-105986.json +++ b/data/2026/CVE-2026-105986.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate  privileges via a percent-encoded role name or a self-assigned role."}],"id":"CVE-2026-105986","lastModified":"2026-11-10T21:17:52.560","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T21:17:52.560","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate  privileges via a percent-encoded role name or a self-assigned role."}],"id":"CVE-2026-105986","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T21:17:52.560","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106023.json b/data/2026/CVE-2026-106023.json index 3b4d181147..b879800733 100644 --- a/data/2026/CVE-2026-106023.json +++ b/data/2026/CVE-2026-106023.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.30","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.69."}],"id":"CVE-2026-106023","lastModified":"2026-11-11T19:17:28.650","metrics":{},"published":"2026-11-11T15:17:13.460","references":[{"source":"security@apache.org","url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/11"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.30","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.69."}],"id":"CVE-2026-106023","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-11T15:17:13.460","references":[{"source":"security@apache.org","url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/11"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106027.json b/data/2026/CVE-2026-106027.json index 5f95ee8dd3..9d632a3a66 100644 --- a/data/2026/CVE-2026-106027.json +++ b/data/2026/CVE-2026-106027.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Oxygen MyData for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"3.0.9","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed."}],"id":"CVE-2026-106027","lastModified":"2026-11-12T12:18:18.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106027","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:19:44.825483Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:10.350","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/6f364114-e016-4c60-9ced-5b726d84bc19/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Oxygen MyData for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"3.0.9","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed."}],"id":"CVE-2026-106027","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106027","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:19:44.825483Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:10.350","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/6f364114-e016-4c60-9ced-5b726d84bc19/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106133.json b/data/2026/CVE-2026-106133.json index 0571215652..9c25a26828 100644 --- a/data/2026/CVE-2026-106133.json +++ b/data/2026/CVE-2026-106133.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik Report Server","vendor":"Progress Software","versions":[{"lessThan":"12.3.26.1110","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability."}],"id":"CVE-2026-106133","lastModified":"2026-11-11T18:18:24.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.023","references":[{"source":"security@progress.com","url":"https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-authorization-cve-2026-106133"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik Report Server","vendor":"Progress Software","versions":[{"lessThan":"12.3.26.1110","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability."}],"id":"CVE-2026-106133","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.023","references":[{"source":"security@progress.com","url":"https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-incorrect-authorization-cve-2026-106133"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-106137.json b/data/2026/CVE-2026-106137.json index aa02b88966..6a5670f103 100644 --- a/data/2026/CVE-2026-106137.json +++ b/data/2026/CVE-2026-106137.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Telerik UI for ASP.NET MVC","vendor":"Progress Software","versions":[{"lessThan":"2026.3.1015","status":"affected","version":"2012.2.710","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version `2026.3.1015`."}],"id":"CVE-2026-106137","lastModified":"2026-11-11T18:18:24.160","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.160","references":[{"source":"security@progress.com","url":"https://www.telerik.com/aspnet-mvc/documentation/knowledge-base/kb-security-class-factory-cve-2026-106137"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-401"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Telerik UI for ASP.NET MVC","vendor":"Progress Software","versions":[{"lessThan":"2026.3.1015","status":"affected","version":"2012.2.710","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version `2026.3.1015`."}],"id":"CVE-2026-106137","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.160","references":[{"source":"security@progress.com","url":"https://www.telerik.com/aspnet-mvc/documentation/knowledge-base/kb-security-class-factory-cve-2026-106137"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-401"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-106140.json b/data/2026/CVE-2026-106140.json index 803ff2b2cf..205c8a46cb 100644 --- a/data/2026/CVE-2026-106140.json +++ b/data/2026/CVE-2026-106140.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik Reporting","vendor":"Progress Software","versions":[{"lessThan":"20.3.26.1110","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations."}],"id":"CVE-2026-106140","lastModified":"2026-11-12T10:17:26.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T10:17:26.987","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/reporting/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-106140"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik Reporting","vendor":"Progress Software","versions":[{"lessThan":"20.3.26.1110","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations."}],"id":"CVE-2026-106140","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T10:17:26.987","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/reporting/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-106140"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-106146.json b/data/2026/CVE-2026-106146.json new file mode 100644 index 0000000000..3aca41eb5c --- /dev/null +++ b/data/2026/CVE-2026-106146.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Telerik UI for ASP.NET MVC","vendor":"Progress Software","versions":[{"lessThanOrEqual":"2026.3.1015","status":"affected","version":"2012.2.710","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version `2026.4.1111`."}],"id":"CVE-2026-106146","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T18:17:12.273","references":[{"source":"security@progress.com","url":"https://www.telerik.com/aspnet-mvc/documentation/knowledge-base/kb-security-filter-processing-cve-2026-106146"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-106152.json b/data/2026/CVE-2026-106152.json index b90a1c9b51..207d9d1bbe 100644 --- a/data/2026/CVE-2026-106152.json +++ b/data/2026/CVE-2026-106152.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik Report Server","vendor":"Progress Software","versions":[{"lessThan":"12.3.26.1110","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover."}],"id":"CVE-2026-106152","lastModified":"2026-11-11T18:18:24.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.290","references":[{"source":"security@progress.com","url":"https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-external-control-of-system-or-configuration-setting-cve-2026-106152"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-15"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik Report Server","vendor":"Progress Software","versions":[{"lessThan":"12.3.26.1110","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover."}],"id":"CVE-2026-106152","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.290","references":[{"source":"security@progress.com","url":"https://www.telerik.com/report-server/documentation/knowledge-base/kb-security-external-control-of-system-or-configuration-setting-cve-2026-106152"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-15"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-106154.json b/data/2026/CVE-2026-106154.json new file mode 100644 index 0000000000..4b84d51733 --- /dev/null +++ b/data/2026/CVE-2026-106154.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Telerik UI for ASP.NET Core","vendor":"Progress Software","versions":[{"lessThanOrEqual":"2026.3.1015","status":"affected","version":"2015.1.318","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`."}],"id":"CVE-2026-106154","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T18:17:12.420","references":[{"source":"security@progress.com","url":"https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-recursion-cve-2026-106154"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-106156.json b/data/2026/CVE-2026-106156.json index 188726c66a..9de34dfdad 100644 --- a/data/2026/CVE-2026-106156.json +++ b/data/2026/CVE-2026-106156.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Telerik UI for ASP.NET Core","vendor":"Progress Software","versions":[{"lessThan":"2026.3.1015","status":"affected","version":"2015.1.318","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`."}],"id":"CVE-2026-106156","lastModified":"2026-11-11T18:18:24.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.423","references":[{"source":"security@progress.com","url":"https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-106156"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Telerik UI for ASP.NET Core","vendor":"Progress Software","versions":[{"lessThan":"2026.3.1015","status":"affected","version":"2015.1.318","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`."}],"id":"CVE-2026-106156","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.423","references":[{"source":"security@progress.com","url":"https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-106156"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-106468.json b/data/2026/CVE-2026-106468.json index 4032141170..cb75a4e24d 100644 --- a/data/2026/CVE-2026-106468.json +++ b/data/2026/CVE-2026-106468.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Code Snippets","vendor":"Unknown","versions":[{"lessThan":"4.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network."}],"id":"CVE-2026-106468","lastModified":"2026-11-11T12:18:24.553","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:34.811875Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.593","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/1f3a3a59-9c84-4bfc-97ee-2f19518ca1a7/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Code Snippets","vendor":"Unknown","versions":[{"lessThan":"4.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network."}],"id":"CVE-2026-106468","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:34.811875Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.593","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/1f3a3a59-9c84-4bfc-97ee-2f19518ca1a7/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106472.json b/data/2026/CVE-2026-106472.json new file mode 100644 index 0000000000..4835049655 --- /dev/null +++ b/data/2026/CVE-2026-106472.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"11.6.16","status":"affected","version":"9.1.0","versionType":"semver"},{"lessThanOrEqual":"12.2.10","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"12.3.11","status":"affected","version":"12.3.0","versionType":"semver"},{"lessThan":"12.4.15","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThan":"13.0.13","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"13.1.10","status":"affected","version":"13.1.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"11.6.16","status":"affected","version":"9.1.0","versionType":"semver"},{"lessThanOrEqual":"12.2.10","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"12.3.11","status":"affected","version":"12.3.0","versionType":"semver"},{"lessThan":"12.4.15","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThan":"13.0.13","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"13.1.10","status":"affected","version":"13.1.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Prometheus Datasource","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.1","versionType":"semver"},{"lessThan":"13.2.6","status":"affected","version":"13.2.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials."}],"id":"CVE-2026-106472","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.0,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-12T18:17:12.560","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-106472"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106475.json b/data/2026/CVE-2026-106475.json new file mode 100644 index 0000000000..4c170ed3c5 --- /dev/null +++ b/data/2026/CVE-2026-106475.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Elasticsearch Datasource","vendor":"Grafana","versions":[{"lessThan":"12.9.6","status":"affected","version":"12.4.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"11.6.16","status":"affected","version":"10.1.0","versionType":"semver"},{"lessThanOrEqual":"12.2.10","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"12.3.11","status":"affected","version":"12.3.0","versionType":"semver"},{"lessThan":"12.4.15","status":"affected","version":"12.4.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"11.6.16","status":"affected","version":"10.1.0","versionType":"semver"},{"lessThanOrEqual":"12.2.10","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"12.3.11","status":"affected","version":"12.3.0","versionType":"semver"},{"lessThan":"12.4.15","status":"affected","version":"12.4.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation]"}],"id":"CVE-2026-106475","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.7,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-12T18:17:12.720","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-106475"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-863"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107152.json b/data/2026/CVE-2026-107152.json new file mode 100644 index 0000000000..e6e362eb0e --- /dev/null +++ b/data/2026/CVE-2026-107152.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task."}],"id":"CVE-2026-107152","lastModified":"2026-11-12T20:18:14.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T20:18:14.680","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107152"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547374"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-107240.json b/data/2026/CVE-2026-107240.json index 09e3f00d7e..3681097a09 100644 --- a/data/2026/CVE-2026-107240.json +++ b/data/2026/CVE-2026-107240.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"Aug 3, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"id":"CVE-2026-107240","lastModified":"2026-11-12T14:17:21.343","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107240","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:31:28.099245Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:10.950","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6af2299bdd1c93ddc0a3e832"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"Aug 3, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"id":"CVE-2026-107240","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107240","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:31:28.099245Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:10.950","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6af2299bdd1c93ddc0a3e832"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107241.json b/data/2026/CVE-2026-107241.json index 55ec81f7bb..b3f0bbd405 100644 --- a/data/2026/CVE-2026-107241.json +++ b/data/2026/CVE-2026-107241.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"Aug 3, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.  \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"id":"CVE-2026-107241","lastModified":"2026-11-12T14:17:21.987","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:29:46.349823Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.187","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6af22a2fdd1c93ddc0a3e834"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"Aug 3, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.  \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"id":"CVE-2026-107241","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:29:46.349823Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.187","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6af22a2fdd1c93ddc0a3e834"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107242.json b/data/2026/CVE-2026-107242.json index a1cee6ac18..4cd5a666f8 100644 --- a/data/2026/CVE-2026-107242.json +++ b/data/2026/CVE-2026-107242.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"Aug 3, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"id":"CVE-2026-107242","lastModified":"2026-11-12T14:17:22.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107242","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:30:45.489761Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.337","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-340"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"Aug 3, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"id":"CVE-2026-107242","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107242","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:30:45.489761Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.337","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-340"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107243.json b/data/2026/CVE-2026-107243.json index 8cdcc3477e..eca3907a68 100644 --- a/data/2026/CVE-2026-107243.json +++ b/data/2026/CVE-2026-107243.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"Aug 3, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"id":"CVE-2026-107243","lastModified":"2026-11-12T14:17:22.307","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107243","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:28:08.560396Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.470","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6af22ae2dd1c93ddc0a3e838"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"Aug 3, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"id":"CVE-2026-107243","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107243","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:28:08.560396Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.470","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6af22ae2dd1c93ddc0a3e838"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107244.json b/data/2026/CVE-2026-107244.json index 2fa4f3900a..a3300bbb17 100644 --- a/data/2026/CVE-2026-107244.json +++ b/data/2026/CVE-2026-107244.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.  \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"id":"CVE-2026-107244","lastModified":"2026-11-12T14:17:22.440","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107244","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:28:44.669092Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.610","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6af22b38dd1c93ddc0a3e83a"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.  \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"id":"CVE-2026-107244","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.0,"impactScore":6.0,"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107244","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:28:44.669092Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.610","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6af22b38dd1c93ddc0a3e83a"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107247.json b/data/2026/CVE-2026-107247.json index cc8f043264..11f27c8d2c 100644 --- a/data/2026/CVE-2026-107247.json +++ b/data/2026/CVE-2026-107247.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"6.0.0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify resources belonging to another agency. Global input registration gives GET parameters precedence over POST parameters, while submitted administration forms use POST values. By supplying authorized object identifiers in the query string and different identifiers in the POST body, an attacker can cause permission checks and subsequent operations to target different objects. This permits unauthorized cross-agency changes, campaign ownership reassignment and disclosure of campaign and banner data. The regression was introduced in commit 156dee7bc3283c128f35e5a31bb305054cc8de1b and is fixed in Revive Adserver 6.0.9 by restoring POST precedence in global input registration."}],"id":"CVE-2026-107247","lastModified":"2026-11-11T18:18:24.560","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.560","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3831102"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"6.0.0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify resources belonging to another agency. Global input registration gives GET parameters precedence over POST parameters, while submitted administration forms use POST values. By supplying authorized object identifiers in the query string and different identifiers in the POST body, an attacker can cause permission checks and subsequent operations to target different objects. This permits unauthorized cross-agency changes, campaign ownership reassignment and disclosure of campaign and banner data. The regression was introduced in commit 156dee7bc3283c128f35e5a31bb305054cc8de1b and is fixed in Revive Adserver 6.0.9 by restoring POST precedence in global input registration."}],"id":"CVE-2026-107247","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.560","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3831102"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107356.json b/data/2026/CVE-2026-107356.json index a6186c5b57..cdc0416162 100644 --- a/data/2026/CVE-2026-107356.json +++ b/data/2026/CVE-2026-107356.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Area Species Management Research Program","vendor":"U.S. Geological Survey","versions":[{"lessThan":"2026-07-20","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026-07-20"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[],"descriptions":[{"lang":"en","value":"U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20."}],"id":"CVE-2026-107356","lastModified":"2026-11-10T22:18:14.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-107356","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-07T19:40:38.054595Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:14.577","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-01.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-107356"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Area Species Management Research Program","vendor":"U.S. Geological Survey","versions":[{"lessThan":"2026-07-20","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026-07-20"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[],"descriptions":[{"lang":"en","value":"U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20."}],"id":"CVE-2026-107356","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-107356","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-07T19:40:38.054595Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:14.577","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-01.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-107356"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107360.json b/data/2026/CVE-2026-107360.json new file mode 100644 index 0000000000..c070ad6766 --- /dev/null +++ b/data/2026/CVE-2026-107360.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"rubygem-safemode","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state."}],"id":"CVE-2026-107360","lastModified":"2026-11-12T20:18:15.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T20:18:14.907","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107360"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547645"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-183"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-107365.json b/data/2026/CVE-2026-107365.json new file mode 100644 index 0000000000..8190f85672 --- /dev/null +++ b/data/2026/CVE-2026-107365.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"(built-in) Google Cloud Monitoring Datasource","vendor":"Grafana","versions":[{"lessThan":"12.6.7","status":"affected","version":"12.4.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"12.3.11","status":"affected","version":"0","versionType":"semver"},{"lessThan":"12.4.15","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThan":"13.0.13","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"13.1.10","status":"affected","version":"13.1.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"12.3.11","status":"affected","version":"0","versionType":"semver"},{"lessThan":"12.4.15","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThan":"13.0.13","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"13.1.10","status":"affected","version":"13.1.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7."}],"id":"CVE-2026-107365","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-12T18:17:12.880","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-107365"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107404.json b/data/2026/CVE-2026-107404.json index f302ab736a..c1936f0439 100644 --- a/data/2026/CVE-2026-107404.json +++ b/data/2026/CVE-2026-107404.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk."}],"id":"CVE-2026-107404","lastModified":"2026-11-10T18:17:18.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:14.063","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk."}],"id":"CVE-2026-107404","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:14.063","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107405.json b/data/2026/CVE-2026-107405.json index 784fcea641..e677211aef 100644 --- a/data/2026/CVE-2026-107405.json +++ b/data/2026/CVE-2026-107405.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service."}],"id":"CVE-2026-107405","lastModified":"2026-11-10T18:17:18.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T17:17:19.177","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-749"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service."}],"id":"CVE-2026-107405","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T17:17:19.177","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-749"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107443.json b/data/2026/CVE-2026-107443.json new file mode 100644 index 0000000000..3006d5ee4c --- /dev/null +++ b/data/2026/CVE-2026-107443.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users."}],"id":"CVE-2026-107443","lastModified":"2026-11-12T20:18:15.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T20:18:15.120","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107443"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-96659"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547760"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-107474.json b/data/2026/CVE-2026-107474.json index 627d1a91d9..ba4664dfcb 100644 --- a/data/2026/CVE-2026-107474.json +++ b/data/2026/CVE-2026-107474.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow","packageURL":"pkg:pypi/apache-airflow","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"2.4.0","versionType":"semver"}]},{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later."}],"id":"CVE-2026-107474","lastModified":"2026-11-10T21:12:54.120","metrics":{},"published":"2026-11-09T10:17:02.820","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73794"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/m7ywzkb3wo9jm6ksgskhgbkbbtll28lx"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/12"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow","packageURL":"pkg:pypi/apache-airflow","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"2.4.0","versionType":"semver"}]},{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later."}],"id":"CVE-2026-107474","lastModified":"2026-11-12T17:17:21.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107474","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:06:08.698885Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:02.820","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73794"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/m7ywzkb3wo9jm6ksgskhgbkbbtll28lx"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/12"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107484.json b/data/2026/CVE-2026-107484.json index ab6919ab85..db56330561 100644 --- a/data/2026/CVE-2026-107484.json +++ b/data/2026/CVE-2026-107484.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Quantum Security Gateway","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]},{"product":"Quantum Security Management","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"source":"cve@checkpoint.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to perform privileged operations that should be restricted to administrators."}],"id":"CVE-2026-107484","lastModified":"2026-11-12T14:17:22.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.2,"source":"cve@checkpoint.com","type":"Secondary"}]},"published":"2026-11-12T14:17:22.897","references":[{"source":"cve@checkpoint.com","url":"https://support.checkpoint.com/results/sk/sk1000291"}],"sourceIdentifier":"cve@checkpoint.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"cve@checkpoint.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Quantum Security Gateway","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]},{"product":"Quantum Security Management","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"source":"cve@checkpoint.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to perform privileged operations that should be restricted to administrators."}],"id":"CVE-2026-107484","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.2,"source":"cve@checkpoint.com","type":"Secondary"}]},"published":"2026-11-12T14:17:22.897","references":[{"source":"cve@checkpoint.com","url":"https://support.checkpoint.com/results/sk/sk1000291"}],"sourceIdentifier":"cve@checkpoint.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"cve@checkpoint.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107509.json b/data/2026/CVE-2026-107509.json index 54bc642dcd..d79bf36b9d 100644 --- a/data/2026/CVE-2026-107509.json +++ b/data/2026/CVE-2026-107509.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value)."}],"id":"CVE-2026-107509","lastModified":"2026-11-11T15:17:13.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:13.943","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-107509"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-789"},{"lang":"en","value":"CWE-1284"}],"source":"security@grafana.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value)."}],"id":"CVE-2026-107509","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:13.943","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-107509"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-789"},{"lang":"en","value":"CWE-1284"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107662.json b/data/2026/CVE-2026-107662.json index 442071be00..32f2452448 100644 --- a/data/2026/CVE-2026-107662.json +++ b/data/2026/CVE-2026-107662.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction."}],"id":"CVE-2026-107662","lastModified":"2026-11-11T18:18:24.690","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.690","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3896779"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary database values through the banner-zone.php and campaign-zone.php administration pages. Permission checks and database queries obtain identifiers through inconsistent request-input precedence, allowing an authorized numeric identifier to pass validation while a different, attacker-controlled value reaches an SQL query. Extracted data can include password hashes and active session identifiers. Reusing an unexpired administrator session can grant administrative access, allowing modification of configuration and disruption of ad delivery. The issue is fixed in Revive Adserver 6.0.9 by consistently selecting POST values before GET values in both global input registration and common input helpers, and excluding cookies from these helpers. Both commits e301dbbb7 and 0aa9d0124 are required for the complete correction."}],"id":"CVE-2026-107662","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:24.690","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3896779"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107776.json b/data/2026/CVE-2026-107776.json index cb11801c40..6d1e111e73 100644 --- a/data/2026/CVE-2026-107776.json +++ b/data/2026/CVE-2026-107776.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"Dokan","vendor":"Unknown","versions":[{"lessThan":"5.3.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout."}],"id":"CVE-2026-107776","lastModified":"2026-11-05T15:06:27.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.2,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":1.4,"source":"contact@wpscan.com","type":"Secondary"}]},"published":"2026-11-05T08:17:03.300","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e34bdc0e-0e33-4ffd-8edb-fef726259e04/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"Dokan","vendor":"Unknown","versions":[{"lessThan":"5.3.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout."}],"id":"CVE-2026-107776","lastModified":"2026-11-12T19:16:45.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.2,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":1.4,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107776","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:20:19.012253Z","version":"2.0.3"}}]},"published":"2026-11-05T08:17:03.300","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e34bdc0e-0e33-4ffd-8edb-fef726259e04/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-107846.json b/data/2026/CVE-2026-107846.json index 3dd6678ce0..639f6c4529 100644 --- a/data/2026/CVE-2026-107846.json +++ b/data/2026/CVE-2026-107846.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"bitcoinjs-lib","vendor":"bitcoinjs","versions":[{"status":"affected","version":">= 2.3.0, < 5.2.1"},{"status":"affected","version":">= 6.0.0, < 6.1.8"},{"status":"affected","version":">= 7.0.0-rc.0, < 7.0.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2."}],"id":"CVE-2026-107846","lastModified":"2026-11-09T17:17:07.793","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107846","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:49:37.173821Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:18.130","references":[{"source":"security-advisories@github.com","url":"https://github.com/bitcoinjs/bitcoinjs-lib/commit/009f165edfbf925cad8964b2dce478d18dd19449"},{"source":"security-advisories@github.com","url":"https://github.com/bitcoinjs/bitcoinjs-lib/commit/b79c7714c0687473dc6e25c69fc5fc597302c7a0"},{"source":"security-advisories@github.com","url":"https://github.com/bitcoinjs/bitcoinjs-lib/commit/f3434d1e4bb5e0784fe769c4cd08a243576232a1"},{"source":"security-advisories@github.com","url":"https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-354"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"bitcoinjs-lib","vendor":"bitcoinjs","versions":[{"status":"affected","version":">= 2.3.0, < 5.2.1"},{"status":"affected","version":">= 6.0.0, < 6.1.8"},{"status":"affected","version":">= 7.0.0-rc.0, < 7.0.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2."}],"id":"CVE-2026-107846","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107846","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:49:37.173821Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:18.130","references":[{"source":"security-advisories@github.com","url":"https://github.com/bitcoinjs/bitcoinjs-lib/commit/009f165edfbf925cad8964b2dce478d18dd19449"},{"source":"security-advisories@github.com","url":"https://github.com/bitcoinjs/bitcoinjs-lib/commit/b79c7714c0687473dc6e25c69fc5fc597302c7a0"},{"source":"security-advisories@github.com","url":"https://github.com/bitcoinjs/bitcoinjs-lib/commit/f3434d1e4bb5e0784fe769c4cd08a243576232a1"},{"source":"security-advisories@github.com","url":"https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-354"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108338.json b/data/2026/CVE-2026-108338.json index 40badba452..8879353a70 100644 --- a/data/2026/CVE-2026-108338.json +++ b/data/2026/CVE-2026-108338.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"5.0.1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier."}],"id":"CVE-2026-108338","lastModified":"2026-11-11T13:17:13.453","metrics":{},"published":"2026-11-11T13:17:13.453","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/208"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/xh4kv1zpdzwtpy57hgm7hy576lz758or"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"5.0.1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier."}],"id":"CVE-2026-108338","lastModified":"2026-11-12T16:59:32.603","metrics":{},"published":"2026-11-11T13:17:13.453","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/208"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/xh4kv1zpdzwtpy57hgm7hy576lz758or"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-108401.json b/data/2026/CVE-2026-108401.json index 7aacedd5b2..db15d1a407 100644 --- a/data/2026/CVE-2026-108401.json +++ b/data/2026/CVE-2026-108401.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network."}],"id":"CVE-2026-108401","lastModified":"2026-11-10T21:17:54.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108401","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:58:06.278688Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:02.807","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108401"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network."}],"id":"CVE-2026-108401","lastModified":"2026-11-10T21:17:54.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108401","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:58:06.278688Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:02.807","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108401"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108402.json b/data/2026/CVE-2026-108402.json index 6aa96d08f6..d92bdccdcc 100644 --- a/data/2026/CVE-2026-108402.json +++ b/data/2026/CVE-2026-108402.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing release of memory after effective lifetime in Windows Layer-2 Bridge Network Driver allows an unauthorized attacker to deny service over an adjacent network."}],"id":"CVE-2026-108402","lastModified":"2026-11-10T21:17:54.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:57:54.350212Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:03.717","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108402"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing release of memory after effective lifetime in Windows Layer-2 Bridge Network Driver allows an unauthorized attacker to deny service over an adjacent network."}],"id":"CVE-2026-108402","lastModified":"2026-11-10T21:17:54.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:57:54.350212Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:03.717","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108402"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108403.json b/data/2026/CVE-2026-108403.json index 14ae6b5be9..b453cbb6b2 100644 --- a/data/2026/CVE-2026-108403.json +++ b/data/2026/CVE-2026-108403.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-108403","lastModified":"2026-11-10T21:17:54.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:57:41.478742Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:07.460","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108403"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-108403","lastModified":"2026-11-10T21:17:54.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:57:41.478742Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:07.460","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108403"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108406.json b/data/2026/CVE-2026-108406.json index 200ccca8ec..f96c93e5e9 100644 --- a/data/2026/CVE-2026-108406.json +++ b/data/2026/CVE-2026-108406.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-108406","lastModified":"2026-11-10T21:17:55.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:57:03.459098Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:09.523","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108406"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-108406","lastModified":"2026-11-10T21:17:55.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:57:03.459098Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:09.523","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108406"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108407.json b/data/2026/CVE-2026-108407.json index 2d10387a56..f8558cb33b 100644 --- a/data/2026/CVE-2026-108407.json +++ b/data/2026/CVE-2026-108407.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows GDI allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-108407","lastModified":"2026-11-10T21:17:55.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:56:50.754825Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:09.897","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108407"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows GDI allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-108407","lastModified":"2026-11-10T21:17:55.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:56:50.754825Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:09.897","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108407"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108408.json b/data/2026/CVE-2026-108408.json index 245aaaade8..0dba758cfe 100644 --- a/data/2026/CVE-2026-108408.json +++ b/data/2026/CVE-2026-108408.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-108408","lastModified":"2026-11-10T21:17:55.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:56:38.565570Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:10.080","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108408"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-108408","lastModified":"2026-11-10T21:17:55.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:56:38.565570Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:10.080","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108408"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108409.json b/data/2026/CVE-2026-108409.json index 349e2e4a72..db9af24fb4 100644 --- a/data/2026/CVE-2026-108409.json +++ b/data/2026/CVE-2026-108409.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-108409","lastModified":"2026-11-10T21:17:55.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108409","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:56:26.718806Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:10.260","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108409"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-108409","lastModified":"2026-11-10T21:17:55.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108409","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:56:26.718806Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:10.260","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108409"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108410.json b/data/2026/CVE-2026-108410.json index 78dc985e5d..17b380de23 100644 --- a/data/2026/CVE-2026-108410.json +++ b/data/2026/CVE-2026-108410.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-108410","lastModified":"2026-11-10T21:17:55.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108410","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:56:14.346460Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:10.440","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108410"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-108410","lastModified":"2026-11-10T21:17:55.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108410","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:56:14.346460Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:10.440","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108410"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108472.json b/data/2026/CVE-2026-108472.json index 5a78f9cd11..02177b4259 100644 --- a/data/2026/CVE-2026-108472.json +++ b/data/2026/CVE-2026-108472.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"xfsprogs","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"xfsprogs","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"xfsprogs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"xfsprogs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed."}],"id":"CVE-2026-108472","lastModified":"2026-11-12T01:17:09.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-11T19:17:29.070","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-108472"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548925"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/27"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"xfsprogs","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.16.0-2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"xfsprogs","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.4.0-8.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"xfsprogs","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"xfsprogs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"xfsprogs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed."}],"id":"CVE-2026-108472","lastModified":"2026-11-12T20:18:15.343","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108472","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:41:15.961858Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:29.070","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99660"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99662"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-108472"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548925"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/27"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108500.json b/data/2026/CVE-2026-108500.json index 404768e732..5937a5a909 100644 --- a/data/2026/CVE-2026-108500.json +++ b/data/2026/CVE-2026-108500.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache ActiveMQ","vendor":"Apache Software Foundation","versions":[{"lessThan":"6.3.3","status":"affected","version":"6.3.0","versionType":"semver"},{"lessThan":"5.19.12","status":"affected","version":"5.19.0","versionType":"semver"},{"status":"unaffected","version":"6.4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue."}],"id":"CVE-2026-108500","lastModified":"2026-11-04T14:10:09.713","metrics":{},"published":"2026-11-04T11:17:13.763","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/0oh4k4ty6hv56d4sydjp26l95f4bsnxt"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/03/16"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache ActiveMQ","vendor":"Apache Software Foundation","versions":[{"lessThan":"6.3.3","status":"affected","version":"6.3.0","versionType":"semver"},{"lessThan":"5.19.12","status":"affected","version":"5.19.0","versionType":"semver"},{"status":"unaffected","version":"6.4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters (such as comma, plus, equals, backslash) can manipulate the LDAP search base used for ACL lookups.\n\n\n\nThis issue affects Apache ActiveMQ: from 6.3.0 before 6.3.3, from 5.19.0 before 5.19.12.\n\n\n\nUsers are recommended to upgrade to version 6.4.0, 6.3.3 or 5.19.12, which fixes the issue."}],"id":"CVE-2026-108500","lastModified":"2026-11-12T20:18:15.567","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:35:16.564655Z","version":"2.0.3"}}]},"published":"2026-11-04T11:17:13.763","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/0oh4k4ty6hv56d4sydjp26l95f4bsnxt"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/03/16"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108558.json b/data/2026/CVE-2026-108558.json index e26b23c64e..60deef0cbe 100644 --- a/data/2026/CVE-2026-108558.json +++ b/data/2026/CVE-2026-108558.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the advertiser identifier instead of the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output issue affects the hour parameter. The issue is fixed in Revive Adserver 6.0.9 by validating the correct website identifier and normalising the hour parameter before formatting."}],"id":"CVE-2026-108558","lastModified":"2026-11-11T18:18:26.227","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.227","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3878649"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. An incorrect ownership check validates the advertiser identifier instead of the supplied website identifier, allowing malicious website input to reach HTML output without appropriate encoding. A related output issue affects the hour parameter. The issue is fixed in Revive Adserver 6.0.9 by validating the correct website identifier and normalising the hour parameter before formatting."}],"id":"CVE-2026-108558","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.227","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3878649"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108559.json b/data/2026/CVE-2026-108559.json index 887b728a49..e6a43e028b 100644 --- a/data/2026/CVE-2026-108559.json +++ b/data/2026/CVE-2026-108559.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When generating invocation tags for an any-size zone, the frame_width and frame_height request parameters are included in HTML attributes without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected values in the invocation-option form fields."}],"id":"CVE-2026-108559","lastModified":"2026-11-11T18:18:26.370","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.370","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3908050"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When generating invocation tags for an any-size zone, the frame_width and frame_height request parameters are included in HTML attributes without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected values in the invocation-option form fields."}],"id":"CVE-2026-108559","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.370","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3908050"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108560.json b/data/2026/CVE-2026-108560.json index da696e2356..a08c51a51c 100644 --- a/data/2026/CVE-2026-108560.json +++ b/data/2026/CVE-2026-108560.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in updates-history.php in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in a victim's browser by persuading them to visit a crafted URL. Attacker-controlled values are included in XML command attributes without appropriate encoding, allowing injection of executable XHTML into the response. The preliminary session check omits GET xajax requests, exposing an unauthenticated attack path, while authenticated administrator requests also reach the unsafe output. The issue is fixed in Revive Adserver 6.0.9 by applying the session check to both GET and POST requests and encoding XML command attribute values in both response serializers."}],"id":"CVE-2026-108560","lastModified":"2026-11-11T18:18:26.497","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.497","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/4075098"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in updates-history.php in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in a victim's browser by persuading them to visit a crafted URL. Attacker-controlled values are included in XML command attributes without appropriate encoding, allowing injection of executable XHTML into the response. The preliminary session check omits GET xajax requests, exposing an unauthenticated attack path, while authenticated administrator requests also reach the unsafe output. The issue is fixed in Revive Adserver 6.0.9 by applying the session check to both GET and POST requests and encoding XML command attribute values in both response serializers."}],"id":"CVE-2026-108560","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.497","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/4075098"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108561.json b/data/2026/CVE-2026-108561.json index 30d9f5ef11..8d047dba91 100644 --- a/data/2026/CVE-2026-108561.json +++ b/data/2026/CVE-2026-108561.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting vulnerability in the report date-selection controls of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in a victim's browser by persuading them to follow a crafted report URL and complete normal reauthentication. An attacker-controlled period_preset value can be saved in the victim's session and inserted into JavaScript without appropriate encoding. The payload can execute on the initial report view and subsequent report views using the stored defaults. The issue is fixed in Revive Adserver 6.0.9 by applying JSON encoding appropriate for the JavaScript context to date-selection values."}],"id":"CVE-2026-108561","lastModified":"2026-11-11T18:18:26.630","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.630","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/4116433"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting vulnerability in the report date-selection controls of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in a victim's browser by persuading them to follow a crafted report URL and complete normal reauthentication. An attacker-controlled period_preset value can be saved in the victim's session and inserted into JavaScript without appropriate encoding. The payload can execute on the initial report view and subsequent report views using the stored defaults. The issue is fixed in Revive Adserver 6.0.9 by applying JSON encoding appropriate for the JavaScript context to date-selection values."}],"id":"CVE-2026-108561","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.630","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/4116433"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108562.json b/data/2026/CVE-2026-108562.json index b245413f44..6b4684eb23 100644 --- a/data/2026/CVE-2026-108562.json +++ b/data/2026/CVE-2026-108562.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting vulnerability in maintenance-appendcode-check.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to execute JavaScript in an administrator's browser. A manager can store a malicious tracker name and cause the tracker to appear in the append-code maintenance results. When an administrator opens the affected maintenance page, the tracker name is included in HTML without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding tracker names when displaying the maintenance results."}],"id":"CVE-2026-108562","lastModified":"2026-11-11T18:18:26.753","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.753","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3826207"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting vulnerability in maintenance-appendcode-check.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to execute JavaScript in an administrator's browser. A manager can store a malicious tracker name and cause the tracker to appear in the append-code maintenance results. When an administrator opens the affected maintenance page, the tracker name is included in HTML without appropriate encoding. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding tracker names when displaying the maintenance results."}],"id":"CVE-2026-108562","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.753","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3826207"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108563.json b/data/2026/CVE-2026-108563.json index 7208d0cc58..e5871903d0 100644 --- a/data/2026/CVE-2026-108563.json +++ b/data/2026/CVE-2026-108563.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet application, attacker-supplied formulas can be evaluated. The confirmed impact is formula execution within the workbook; disclosure of information to the attacker has not been established. The issue is fixed in Revive Adserver 6.0.9 by sanitising conversion values before writing them to the affected XLS report sections."}],"id":"CVE-2026-108563","lastModified":"2026-11-11T18:18:26.883","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.883","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3859000"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spreadsheet formula injection in conversion-tracking report exports in Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to submit conversion values that are written as formulas instead of text in an XLS workbook. When a user opens the exported report in a spreadsheet application, attacker-supplied formulas can be evaluated. The confirmed impact is formula execution within the workbook; disclosure of information to the attacker has not been established. The issue is fixed in Revive Adserver 6.0.9 by sanitising conversion values before writing them to the affected XLS report sections."}],"id":"CVE-2026-108563","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:26.883","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3859000"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108564.json b/data/2026/CVE-2026-108564.json index f20d6891f7..87cd91a926 100644 --- a/data/2026/CVE-2026-108564.json +++ b/data/2026/CVE-2026-108564.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields."}],"id":"CVE-2026-108564","lastModified":"2026-11-11T18:18:27.023","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:27.023","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3942028"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. When Direct Selection is enabled, an attacker-controlled banner identifier can be included in HTML form fields without appropriate encoding. Direct Selection is disabled by default. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding banner identifier values in the invocation-option form fields."}],"id":"CVE-2026-108564","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:27.023","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3942028"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108565.json b/data/2026/CVE-2026-108565.json index f02b442d30..4fc0d3f457 100644 --- a/data/2026/CVE-2026-108565.json +++ b/data/2026/CVE-2026-108565.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in the popup invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. The top, left, timeout and delay request parameters are included in HTML attributes without appropriate encoding. Exploitation requires an existing popup zone, which can be created through the administrator API but is not offered by the normal zone-creation interface. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected popup option values."}],"id":"CVE-2026-108565","lastModified":"2026-11-11T18:18:27.147","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:27.147","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3971985"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability in the popup invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. The top, left, timeout and delay request parameters are included in HTML attributes without appropriate encoding. Exploitation requires an existing popup zone, which can be created through the administrator API but is not offered by the normal zone-creation interface. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected popup option values."}],"id":"CVE-2026-108565","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:18:27.147","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3971985"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-109163.json b/data/2026/CVE-2026-109163.json index 10b4dfed81..24a6873563 100644 --- a/data/2026/CVE-2026-109163.json +++ b/data/2026/CVE-2026-109163.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.69","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292)\n\n\n\nThis issue affects Apache HTTP Server: 2.4.69."}],"id":"CVE-2026-109163","lastModified":"2026-11-11T15:17:14.097","metrics":{},"published":"2026-11-11T15:17:14.097","references":[{"source":"security@apache.org","url":"https://httpd.apache.org/security/vulnerabilities_24.html"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.69","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292)\n\n\n\nThis issue affects Apache HTTP Server: 2.4.69."}],"id":"CVE-2026-109163","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-11T15:17:14.097","references":[{"source":"security@apache.org","url":"https://httpd.apache.org/security/vulnerabilities_24.html"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-109408.json b/data/2026/CVE-2026-109408.json index 197ec453d0..5fc3bc41a9 100644 --- a/data/2026/CVE-2026-109408.json +++ b/data/2026/CVE-2026-109408.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"io.github.jopenlibs:vault-java-driver","product":"vault-java-driver","programFiles":["src/main/java/io/github/jopenlibs/vault/SslConfig.java","src/main/java/io/github/jopenlibs/vault/rest/Rest.java"],"repo":"https://github.com/jopenlibs/vault-java-driver","vendor":"jopenlibs","versions":[{"lessThan":"7.0.0","status":"affected","version":"5.2.0","versionType":"maven"}]}],"source":"abd028dc-c042-4c4d-9749-38d0f850af89"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0."}],"id":"CVE-2026-109408","lastModified":"2026-11-05T19:17:07.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"abd028dc-c042-4c4d-9749-38d0f850af89","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:40:51.548101Z","version":"2.0.3"}}]},"published":"2026-11-05T08:17:03.463","references":[{"source":"abd028dc-c042-4c4d-9749-38d0f850af89","url":"https://github.com/jopenlibs/vault-java-driver/pull/78"},{"source":"abd028dc-c042-4c4d-9749-38d0f850af89","url":"https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/"}],"sourceIdentifier":"abd028dc-c042-4c4d-9749-38d0f850af89","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-297"},{"lang":"en","value":"CWE-636"}],"source":"abd028dc-c042-4c4d-9749-38d0f850af89","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"io.github.jopenlibs:vault-java-driver","product":"vault-java-driver","programFiles":["src/main/java/io/github/jopenlibs/vault/SslConfig.java","src/main/java/io/github/jopenlibs/vault/rest/Rest.java"],"repo":"https://github.com/jopenlibs/vault-java-driver","vendor":"jopenlibs","versions":[{"lessThan":"7.0.0","status":"affected","version":"5.2.0","versionType":"maven"}]}],"source":"abd028dc-c042-4c4d-9749-38d0f850af89"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0."}],"id":"CVE-2026-109408","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"abd028dc-c042-4c4d-9749-38d0f850af89","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:40:51.548101Z","version":"2.0.3"}}]},"published":"2026-11-05T08:17:03.463","references":[{"source":"abd028dc-c042-4c4d-9749-38d0f850af89","url":"https://github.com/jopenlibs/vault-java-driver/pull/78"},{"source":"abd028dc-c042-4c4d-9749-38d0f850af89","url":"https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/"}],"sourceIdentifier":"abd028dc-c042-4c4d-9749-38d0f850af89","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-297"},{"lang":"en","value":"CWE-636"}],"source":"abd028dc-c042-4c4d-9749-38d0f850af89","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-109518.json b/data/2026/CVE-2026-109518.json index 8f0c3cefe0..94708deb8a 100644 --- a/data/2026/CVE-2026-109518.json +++ b/data/2026/CVE-2026-109518.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"apt","product":"APT","vendor":"Debian","versions":[{"lessThan":"1.2.36","status":"affected","version":"0","versionType":"dpkg"},{"lessThan":"1.4.12","status":"affected","version":"1.4.0","versionType":"dpkg"},{"lessThan":"1.6.19","status":"affected","version":"1.6.0","versionType":"dpkg"},{"lessThan":"1.8.2.4","status":"affected","version":"1.8.0","versionType":"dpkg"},{"lessThanOrEqual":"1.8.5","status":"affected","version":"1.8.3","versionType":"dpkg"},{"lessThan":"2.0.12","status":"affected","version":"2.0.0","versionType":"dpkg"},{"lessThan":"2.2.5","status":"affected","version":"2.2.0","versionType":"dpkg"},{"lessThan":"2.4.15","status":"affected","version":"2.4.0","versionType":"dpkg"},{"lessThan":"2.6.2","status":"affected","version":"2.6.0","versionType":"dpkg"},{"lessThan":"2.8.4","status":"affected","version":"2.8.0","versionType":"dpkg"},{"lessThan":"3.0.4","status":"affected","version":"3.0.0","versionType":"dpkg"},{"lessThan":"3.2.1","status":"affected","version":"3.2.0","versionType":"dpkg"},{"lessThan":"3.3.6","status":"affected","version":"3.3.0","versionType":"dpkg"}]},{"defaultStatus":"unaffected","packageName":"apt","product":"APT","vendor":"Ubuntu","versions":[{"lessThan":"1.0.1ubuntu2.24+esm4","status":"affected","version":"0","versionType":"dpkg"},{"lessThan":"1.2.36+esm1","status":"affected","version":"1.2.0","versionType":"dpkg"},{"lessThan":"1.6.19+esm1","status":"affected","version":"1.6.0","versionType":"dpkg"},{"lessThan":"2.0.12+esm1","status":"affected","version":"2.0.0","versionType":"dpkg"},{"lessThan":"2.4.15ubuntu0.1","status":"affected","version":"2.4.0","versionType":"dpkg"},{"lessThan":"2.8.4ubuntu0.1","status":"affected","version":"2.8.0","versionType":"dpkg"},{"lessThan":"3.2.1ubuntu0.1","status":"affected","version":"3.2.0","versionType":"dpkg"},{"lessThan":"3.3.3ubuntu0.1","status":"affected","version":"3.3.0","versionType":"dpkg"}]}],"source":"security@ubuntu.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}],"id":"CVE-2026-109518","lastModified":"2026-11-05T05:18:19.033","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@ubuntu.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109518","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-04T16:17:33.010","references":[{"source":"security@ubuntu.com","url":"https://lists.debian.org/debian-security-announce/2026/msg00526.html"},{"source":"security@ubuntu.com","url":"https://ubuntu.com/security/notices/USN-8996-1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/04/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"}],"sourceIdentifier":"security@ubuntu.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-62"},{"lang":"en","value":"CWE-367"}],"source":"security@ubuntu.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"apt","product":"APT","vendor":"Debian","versions":[{"lessThan":"1.2.36","status":"affected","version":"0","versionType":"dpkg"},{"lessThan":"1.4.12","status":"affected","version":"1.4.0","versionType":"dpkg"},{"lessThan":"1.6.19","status":"affected","version":"1.6.0","versionType":"dpkg"},{"lessThan":"1.8.2.4","status":"affected","version":"1.8.0","versionType":"dpkg"},{"lessThanOrEqual":"1.8.5","status":"affected","version":"1.8.3","versionType":"dpkg"},{"lessThan":"2.0.12","status":"affected","version":"2.0.0","versionType":"dpkg"},{"lessThan":"2.2.5","status":"affected","version":"2.2.0","versionType":"dpkg"},{"lessThan":"2.4.15","status":"affected","version":"2.4.0","versionType":"dpkg"},{"lessThan":"2.6.2","status":"affected","version":"2.6.0","versionType":"dpkg"},{"lessThan":"2.8.4","status":"affected","version":"2.8.0","versionType":"dpkg"},{"lessThan":"3.0.4","status":"affected","version":"3.0.0","versionType":"dpkg"},{"lessThan":"3.2.1","status":"affected","version":"3.2.0","versionType":"dpkg"},{"lessThan":"3.3.6","status":"affected","version":"3.3.0","versionType":"dpkg"}]},{"defaultStatus":"unaffected","packageName":"apt","product":"APT","vendor":"Ubuntu","versions":[{"lessThan":"1.0.1ubuntu2.24+esm4","status":"affected","version":"0","versionType":"dpkg"},{"lessThan":"1.2.36+esm1","status":"affected","version":"1.2.0","versionType":"dpkg"},{"lessThan":"1.6.19+esm1","status":"affected","version":"1.6.0","versionType":"dpkg"},{"lessThan":"2.0.12+esm1","status":"affected","version":"2.0.0","versionType":"dpkg"},{"lessThan":"2.4.15ubuntu0.1","status":"affected","version":"2.4.0","versionType":"dpkg"},{"lessThan":"2.8.4ubuntu0.1","status":"affected","version":"2.8.0","versionType":"dpkg"},{"lessThan":"3.2.1ubuntu0.1","status":"affected","version":"3.2.0","versionType":"dpkg"},{"lessThan":"3.3.3ubuntu0.1","status":"affected","version":"3.3.0","versionType":"dpkg"}]}],"source":"security@ubuntu.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}],"id":"CVE-2026-109518","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@ubuntu.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109518","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-04T16:17:33.010","references":[{"source":"security@ubuntu.com","url":"https://lists.debian.org/debian-security-announce/2026/msg00526.html"},{"source":"security@ubuntu.com","url":"https://ubuntu.com/security/notices/USN-8996-1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/04/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"}],"sourceIdentifier":"security@ubuntu.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-62"},{"lang":"en","value":"CWE-367"}],"source":"security@ubuntu.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-109582.json b/data/2026/CVE-2026-109582.json index 7b77721446..b62501a7e5 100644 --- a/data/2026/CVE-2026-109582.json +++ b/data/2026/CVE-2026-109582.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SS1","vendor":"DOS Co., Ltd.","versions":[{"lessThanOrEqual":"Agent version 17.0.0.50 (Media Versions 17.0.0e)","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by the product may be obtained."}],"id":"CVE-2026-109582","lastModified":"2026-11-12T15:17:35.467","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.0"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:42:35.682111Z","version":"2.0.3"}}]},"published":"2026-11-09T08:17:00.860","references":[{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/jp/JVN76179675/"},{"source":"vultures@jpcert.or.jp","url":"https://www.dos-osaka.co.jp/news/2026/11/261109.html"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-922"}],"source":"vultures@jpcert.or.jp","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SS1","vendor":"DOS Co., Ltd.","versions":[{"lessThanOrEqual":"Agent version 17.0.0.50 (Media Versions 17.0.0e)","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by the product may be obtained."}],"id":"CVE-2026-109582","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.0"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:42:35.682111Z","version":"2.0.3"}}]},"published":"2026-11-09T08:17:00.860","references":[{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/jp/JVN76179675/"},{"source":"vultures@jpcert.or.jp","url":"https://www.dos-osaka.co.jp/news/2026/11/261109.html"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-922"}],"source":"vultures@jpcert.or.jp","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-109683.json b/data/2026/CVE-2026-109683.json index 5f79a15157..8189bd6525 100644 --- a/data/2026/CVE-2026-109683.json +++ b/data/2026/CVE-2026-109683.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Archer BE805 v1","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"V1.6_1.5.1 Build 261102","status":"affected","version":"0","versionType":"custom"},{"lessThan":"V1.20_1.5.1 Build 261102","status":"affected","version":"0","versionType":"custom"}]}],"source":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A newline\ninjection vulnerability exists in the UPnP service of Archer BE805 v1 such that\nan adjacent attacker can supply newline characters in a UPnP port-mapping\ndescription due to improper sanitization, resulting in possible injection of unintended\ncontent into UPnP port-mapping data.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker on the local network to\nmodify runtime UPnP port-mapping information and create spoofed entries within\nthe affected service. The issue is limited to the integrity of UPnP mapping\ndata and does not demonstrate code execution or privilege escalation."}],"id":"CVE-2026-109683","lastModified":"2026-11-06T21:15:29.947","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary"}]},"published":"2026-11-06T20:17:09.863","references":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","url":"https://www.tp-link.com/en/support/download/archer-be805/v1.20/#Firmware"},{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","url":"https://www.tp-link.com/us/support/download/archer-be805/#Firmware"},{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","url":"https://www.tp-link.com/us/support/faq/5389/"}],"sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Archer BE805 v1","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"V1.6_1.5.1 Build 261102","status":"affected","version":"0","versionType":"custom"},{"lessThan":"V1.20_1.5.1 Build 261102","status":"affected","version":"0","versionType":"custom"}]}],"source":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A newline\ninjection vulnerability exists in the UPnP service of Archer BE805 v1 such that\nan adjacent attacker can supply newline characters in a UPnP port-mapping\ndescription due to improper sanitization, resulting in possible injection of unintended\ncontent into UPnP port-mapping data.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker on the local network to\nmodify runtime UPnP port-mapping information and create spoofed entries within\nthe affected service. The issue is limited to the integrity of UPnP mapping\ndata and does not demonstrate code execution or privilege escalation."}],"id":"CVE-2026-109683","lastModified":"2026-11-12T19:16:45.990","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109683","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:07:08.142396Z","version":"2.0.3"}}]},"published":"2026-11-06T20:17:09.863","references":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","url":"https://www.tp-link.com/en/support/download/archer-be805/v1.20/#Firmware"},{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","url":"https://www.tp-link.com/us/support/download/archer-be805/#Firmware"},{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","url":"https://www.tp-link.com/us/support/faq/5389/"}],"sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-109870.json b/data/2026/CVE-2026-109870.json index 99ac4a5ee0..6f8e40fa53 100644 --- a/data/2026/CVE-2026-109870.json +++ b/data/2026/CVE-2026-109870.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"User Registration & Membership","vendor":"Unknown","versions":[{"lessThan":"5.3.2","status":"affected","version":"5.2.8","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role."}],"id":"CVE-2026-109870","lastModified":"2026-11-11T12:18:30.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:20.772068Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.727","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/6cac7dd1-2ae5-4b5b-94c7-a8a4a63ef84b/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"User Registration & Membership","vendor":"Unknown","versions":[{"lessThan":"5.3.2","status":"affected","version":"5.2.8","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role."}],"id":"CVE-2026-109870","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:20.772068Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.727","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/6cac7dd1-2ae5-4b5b-94c7-a8a4a63ef84b/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-109871.json b/data/2026/CVE-2026-109871.json index dc10d4d9a3..fe302c2c4e 100644 --- a/data/2026/CVE-2026-109871.json +++ b/data/2026/CVE-2026-109871.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"User Registration & Membership","vendor":"Unknown","versions":[{"lessThan":"5.3.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying."}],"id":"CVE-2026-109871","lastModified":"2026-11-11T12:18:30.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109871","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:11.820613Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.860","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/444889b1-ae92-45b6-a13b-e76a5fa7ce58/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"User Registration & Membership","vendor":"Unknown","versions":[{"lessThan":"5.3.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely without paying."}],"id":"CVE-2026-109871","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109871","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:11.820613Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.860","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/444889b1-ae92-45b6-a13b-e76a5fa7ce58/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-109873.json b/data/2026/CVE-2026-109873.json index 92f7eaa3d1..42047af8ba 100644 --- a/data/2026/CVE-2026-109873.json +++ b/data/2026/CVE-2026-109873.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"User Registration & Membership","vendor":"Unknown","versions":[{"lessThan":"5.3.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated registration form and log in without completing payment."}],"id":"CVE-2026-109873","lastModified":"2026-11-11T12:18:30.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109873","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:03.646149Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.013","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/4cce0bb5-eb8e-4452-a6d1-6c408344bc7f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"User Registration & Membership","vendor":"Unknown","versions":[{"lessThan":"5.3.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated registration form and log in without completing payment."}],"id":"CVE-2026-109873","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109873","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:03.646149Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.013","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/4cce0bb5-eb8e-4452-a6d1-6c408344bc7f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110016.json b/data/2026/CVE-2026-110016.json index d3c4265af0..1f9b1a2cec 100644 --- a/data/2026/CVE-2026-110016.json +++ b/data/2026/CVE-2026-110016.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Data Tables Generator by Supsystic","vendor":"Unknown","versions":[{"lessThan":"1.15.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Data Tables Generator by Supsystic WordPress plugin before 1.15.8 does not perform any authorization or ownership check before returning the stored contents of a table, relying only on a nonce that is exposed to every anonymous visitor, allowing unauthenticated users to read the full contents of any table by its identifier, including tables that are never published anywhere on the site."}],"id":"CVE-2026-110016","lastModified":"2026-11-11T12:18:30.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110016","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:26:52.253028Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.157","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/3ff8c1cc-3975-4302-a69f-11a4538dd4e8/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Data Tables Generator by Supsystic","vendor":"Unknown","versions":[{"lessThan":"1.15.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Data Tables Generator by Supsystic WordPress plugin before 1.15.8 does not perform any authorization or ownership check before returning the stored contents of a table, relying only on a nonce that is exposed to every anonymous visitor, allowing unauthenticated users to read the full contents of any table by its identifier, including tables that are never published anywhere on the site."}],"id":"CVE-2026-110016","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110016","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:26:52.253028Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.157","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/3ff8c1cc-3975-4302-a69f-11a4538dd4e8/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110021.json b/data/2026/CVE-2026-110021.json index a11aca2205..4559e60caa 100644 --- a/data/2026/CVE-2026-110021.json +++ b/data/2026/CVE-2026-110021.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PLCnext Engineer","vendor":"Phoenix Contact","versions":[{"lessThan":"2026.6","status":"affected","version":"0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy."}],"id":"CVE-2026-110021","lastModified":"2026-11-04T20:18:55.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110021","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:09:18.085257Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:24.310","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-121/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PLCnext Engineer","vendor":"Phoenix Contact","versions":[{"lessThan":"2026.6","status":"affected","version":"0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy."}],"id":"CVE-2026-110021","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110021","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:09:18.085257Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:24.310","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-121/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110022.json b/data/2026/CVE-2026-110022.json index 8ac7c7add7..716a3f6877 100644 --- a/data/2026/CVE-2026-110022.json +++ b/data/2026/CVE-2026-110022.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PLCnext Engineer","vendor":"Phoenix Contact","versions":[{"lessThan":"2026.6","status":"affected","version":"0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems."}],"id":"CVE-2026-110022","lastModified":"2026-11-04T20:18:55.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110022","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:10:17.506128Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:24.473","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-121/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-494"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PLCnext Engineer","vendor":"Phoenix Contact","versions":[{"lessThan":"2026.6","status":"affected","version":"0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems."}],"id":"CVE-2026-110022","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110022","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:10:17.506128Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:24.473","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-121/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-494"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110041.json b/data/2026/CVE-2026-110041.json index 0c402cc8cc..51eeaffb85 100644 --- a/data/2026/CVE-2026-110041.json +++ b/data/2026/CVE-2026-110041.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Crop Thumbnails","vendor":"Unknown","versions":[{"lessThan":"1.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users."}],"id":"CVE-2026-110041","lastModified":"2026-11-12T12:18:18.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110041","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:19:33.722954Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:10.863","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/f79fa2e0-ebba-4075-84d9-b5fadfbd6ca4/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Crop Thumbnails","vendor":"Unknown","versions":[{"lessThan":"1.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users."}],"id":"CVE-2026-110041","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110041","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:19:33.722954Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:10.863","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/f79fa2e0-ebba-4075-84d9-b5fadfbd6ca4/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110072.json b/data/2026/CVE-2026-110072.json index 69bbf19b74..5555b544ae 100644 --- a/data/2026/CVE-2026-110072.json +++ b/data/2026/CVE-2026-110072.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Photo Gallery by 10Web","vendor":"Unknown","versions":[{"lessThan":"1.8.49","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery."}],"id":"CVE-2026-110072","lastModified":"2026-11-12T12:18:18.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:19:24.076204Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:10.983","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/6bf17a5c-21c4-4e0e-b0a4-aee18c9820f1/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Photo Gallery by 10Web","vendor":"Unknown","versions":[{"lessThan":"1.8.49","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery."}],"id":"CVE-2026-110072","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:19:24.076204Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:10.983","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/6bf17a5c-21c4-4e0e-b0a4-aee18c9820f1/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110289.json b/data/2026/CVE-2026-110289.json index bb5b4a6361..ccbff765ec 100644 --- a/data/2026/CVE-2026-110289.json +++ b/data/2026/CVE-2026-110289.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery)."}],"id":"CVE-2026-110289","lastModified":"2026-11-11T15:17:14.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:14.230","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-110289"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@grafana.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery)."}],"id":"CVE-2026-110289","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:14.230","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-110289"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110390.json b/data/2026/CVE-2026-110390.json index bf4471ff57..a02416e014 100644 --- a/data/2026/CVE-2026-110390.json +++ b/data/2026/CVE-2026-110390.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"FlexNet Beacon","vendor":"Flexera","versions":[{"lessThan":"26.4.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["FlexNet Beacon"],"platforms":["Windows"],"product":"FlexNet Manager Suite","vendor":"Flexera","versions":[{"changes":[{"at":"2026 R1 IOK-2107311","status":"unaffected"}],"lessThan":"2026 R2","status":"affected","version":"2026 R1","versionType":"custom"},{"changes":[{"at":"2025 R2 IOK-2107311","status":"unaffected"}],"lessThan":"2026 R1","status":"affected","version":"2025 R2","versionType":"custom"},{"changes":[{"at":"2025 R1 IOK-2107311","status":"unaffected"}],"lessThan":"2025 R2","status":"affected","version":"2025 R1","versionType":"custom"},{"lessThan":"2025 R1","status":"affected","version":"0","versionType":"custom"}]}],"source":"PSIRT-CNA@flexerasoftware.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default)."}],"id":"CVE-2026-110390","lastModified":"2026-11-10T14:17:11.663","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"PSIRT-CNA@flexerasoftware.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110390","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:01:05.369765Z","version":"2.0.3"}}]},"published":"2026-11-05T23:16:50.370","references":[{"source":"PSIRT-CNA@flexerasoftware.com","url":"https://community.flexera.com/s/article/Flexera-Beacon-Security-Advisory-CVE-2026-110390"},{"source":"PSIRT-CNA@flexerasoftware.com","url":"https://community.flexera.com/s/article/Flexera-Beacon-security-hotfix-IOK-2107311"}],"sourceIdentifier":"PSIRT-CNA@flexerasoftware.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-497"}],"source":"PSIRT-CNA@flexerasoftware.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"FlexNet Beacon","vendor":"Flexera","versions":[{"lessThan":"26.4.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","modules":["FlexNet Beacon"],"platforms":["Windows"],"product":"FlexNet Manager Suite","vendor":"Flexera","versions":[{"changes":[{"at":"2026 R1 IOK-2107311","status":"unaffected"}],"lessThan":"2026 R2","status":"affected","version":"2026 R1","versionType":"custom"},{"changes":[{"at":"2025 R2 IOK-2107311","status":"unaffected"}],"lessThan":"2026 R1","status":"affected","version":"2025 R2","versionType":"custom"},{"changes":[{"at":"2025 R1 IOK-2107311","status":"unaffected"}],"lessThan":"2025 R2","status":"affected","version":"2025 R1","versionType":"custom"},{"lessThan":"2025 R1","status":"affected","version":"0","versionType":"custom"}]}],"source":"PSIRT-CNA@flexerasoftware.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default)."}],"id":"CVE-2026-110390","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"PSIRT-CNA@flexerasoftware.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110390","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:01:05.369765Z","version":"2.0.3"}}]},"published":"2026-11-05T23:16:50.370","references":[{"source":"PSIRT-CNA@flexerasoftware.com","url":"https://community.flexera.com/s/article/Flexera-Beacon-Security-Advisory-CVE-2026-110390"},{"source":"PSIRT-CNA@flexerasoftware.com","url":"https://community.flexera.com/s/article/Flexera-Beacon-security-hotfix-IOK-2107311"}],"sourceIdentifier":"PSIRT-CNA@flexerasoftware.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-497"}],"source":"PSIRT-CNA@flexerasoftware.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110464.json b/data/2026/CVE-2026-110464.json index 86cbb3df06..8882d270f7 100644 --- a/data/2026/CVE-2026-110464.json +++ b/data/2026/CVE-2026-110464.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Armoury Crate","vendor":"ASUS","versions":[{"lessThanOrEqual":"v6.5.14","status":"affected","version":"v5.4.10","versionType":"custom"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry location with Local System privileges, or to cause a recoverable system crash, via the service's exposed inter-process interface.\nRefer to the '\nSecurity Update for Armoury Crate App ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-110464","lastModified":"2026-11-04T16:17:33.210","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T14:55:17.685655Z","version":"2.0.3"}}]},"published":"2026-11-04T02:17:14.800","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Armoury Crate","vendor":"ASUS","versions":[{"lessThanOrEqual":"v6.5.14","status":"affected","version":"v5.4.10","versionType":"custom"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry location with Local System privileges, or to cause a recoverable system crash, via the service's exposed inter-process interface.\nRefer to the '\nSecurity Update for Armoury Crate App ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-110464","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T14:55:17.685655Z","version":"2.0.3"}}]},"published":"2026-11-04T02:17:14.800","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110468.json b/data/2026/CVE-2026-110468.json index 6385365312..aa67656352 100644 --- a/data/2026/CVE-2026-110468.json +++ b/data/2026/CVE-2026-110468.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["/panel/controllers/save_photo.php"],"product":"WidzialniCMS","vendor":"Fundacja Widzialni","versions":[{"lessThan":"2.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\n\n\nThis issue has been fixed in version 2.5."}],"id":"CVE-2026-110468","lastModified":"2026-11-09T18:17:19.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110468","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:51:32.057069Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:03.687","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-110468"},{"source":"cvd@cert.pl","url":"https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"cvd@cert.pl","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["/panel/controllers/save_photo.php"],"product":"WidzialniCMS","vendor":"Fundacja Widzialni","versions":[{"lessThan":"2.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\n\n\nThis issue has been fixed in version 2.5."}],"id":"CVE-2026-110468","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110468","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:51:32.057069Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:03.687","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-110468"},{"source":"cvd@cert.pl","url":"https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"cvd@cert.pl","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110469.json b/data/2026/CVE-2026-110469.json index db01f20f55..06ee153293 100644 --- a/data/2026/CVE-2026-110469.json +++ b/data/2026/CVE-2026-110469.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["/panel/upload.php"],"product":"WidzialniCMS","vendor":"Fundacja Widzialni","versions":[{"lessThan":"2.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\n\n\nThis issue has been fixed in version 2.5."}],"id":"CVE-2026-110469","lastModified":"2026-11-09T18:17:19.690","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110469","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:50:35.392549Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:03.910","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-110468"},{"source":"cvd@cert.pl","url":"https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"cvd@cert.pl","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["/panel/upload.php"],"product":"WidzialniCMS","vendor":"Fundacja Widzialni","versions":[{"lessThan":"2.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\n\n\nThis issue has been fixed in version 2.5."}],"id":"CVE-2026-110469","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110469","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:50:35.392549Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:03.910","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-110468"},{"source":"cvd@cert.pl","url":"https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"cvd@cert.pl","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110935.json b/data/2026/CVE-2026-110935.json index 0bd5dae632..a354950c92 100644 --- a/data/2026/CVE-2026-110935.json +++ b/data/2026/CVE-2026-110935.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PLCnext Engineer","vendor":"Phoenix Contact","versions":[{"lessThan":"2026.6","status":"affected","version":"0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise."}],"id":"CVE-2026-110935","lastModified":"2026-11-04T20:18:55.343","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110935","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:10:56.660295Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:24.627","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-121/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PLCnext Engineer","vendor":"Phoenix Contact","versions":[{"lessThan":"2026.6","status":"affected","version":"0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise."}],"id":"CVE-2026-110935","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110935","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:10:56.660295Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:24.627","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-121/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110948.json b/data/2026/CVE-2026-110948.json index b55b1c86d3..df7e967ead 100644 --- a/data/2026/CVE-2026-110948.json +++ b/data/2026/CVE-2026-110948.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Download Manager","vendor":"Unknown","versions":[{"lessThan":"3.3.73","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Download Manager","vendor":"Unknown","versions":[{"lessThan":"7.6.2","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors to download password-locked and role-restricted files by reading the key from a public page."}],"id":"CVE-2026-110948","lastModified":"2026-11-11T12:18:32.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110948","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:26:39.297204Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.320","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/42a914ea-54fe-4a2b-b65b-8da152a37b43/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Download Manager","vendor":"Unknown","versions":[{"lessThan":"3.3.73","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Download Manager","vendor":"Unknown","versions":[{"lessThan":"7.6.2","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors to download password-locked and role-restricted files by reading the key from a public page."}],"id":"CVE-2026-110948","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110948","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:26:39.297204Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.320","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/42a914ea-54fe-4a2b-b65b-8da152a37b43/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110949.json b/data/2026/CVE-2026-110949.json index 0536ac4723..9ab2c54bea 100644 --- a/data/2026/CVE-2026-110949.json +++ b/data/2026/CVE-2026-110949.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Download Manager","vendor":"Unknown","versions":[{"lessThan":"3.3.73","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Download Manager","vendor":"Unknown","versions":[{"lessThan":"7.6.2","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file."}],"id":"CVE-2026-110949","lastModified":"2026-11-11T12:18:32.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110949","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:26:28.792059Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.477","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/2ee629f0-d410-4272-991c-1eb6001fceb4/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Download Manager","vendor":"Unknown","versions":[{"lessThan":"3.3.73","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Download Manager","vendor":"Unknown","versions":[{"lessThan":"7.6.2","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file."}],"id":"CVE-2026-110949","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110949","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:26:28.792059Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.477","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/2ee629f0-d410-4272-991c-1eb6001fceb4/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110951.json b/data/2026/CVE-2026-110951.json index 93b2631ea7..f501090ca0 100644 --- a/data/2026/CVE-2026-110951.json +++ b/data/2026/CVE-2026-110951.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure - dealer integration","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure - Storefront application and management panel","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"2.1796","status":"affected","version":"0","versionType":"custom"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Password Recovery Exploitation.\n\nThis issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796."}],"id":"CVE-2026-110951","lastModified":"2026-11-12T13:17:08.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-12T13:17:08.390","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1531"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure - dealer integration","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure - Storefront application and management panel","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"2.1796","status":"affected","version":"0","versionType":"custom"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Password Recovery Exploitation.\n\nThis issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796."}],"id":"CVE-2026-110951","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-12T13:17:08.390","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1531"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} diff --git a/data/2026/CVE-2026-110959.json b/data/2026/CVE-2026-110959.json index 6b5d29f6da..5e5bf1a137 100644 --- a/data/2026/CVE-2026-110959.json +++ b/data/2026/CVE-2026-110959.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Descope","vendor":"Unknown","versions":[{"lessThan":"1.2.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address."}],"id":"CVE-2026-110959","lastModified":"2026-11-12T12:18:18.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110959","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:19:14.827348Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:11.100","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/8b97f139-cbc3-4913-b69a-a3179f4cc264/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Descope","vendor":"Unknown","versions":[{"lessThan":"1.2.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress session, accepting any non-empty token, so an unauthenticated attacker can obtain a session for any existing account, including an administrator, by supplying that account's email address."}],"id":"CVE-2026-110959","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110959","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:19:14.827348Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:11.100","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/8b97f139-cbc3-4913-b69a-a3179f4cc264/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110992.json b/data/2026/CVE-2026-110992.json index 4b913d6bf7..7b5a8ef695 100644 --- a/data/2026/CVE-2026-110992.json +++ b/data/2026/CVE-2026-110992.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host."}],"id":"CVE-2026-110992","lastModified":"2026-11-11T15:17:14.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:14.370","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-110992"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}],"source":"security@grafana.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host."}],"id":"CVE-2026-110992","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:14.370","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-110992"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111000.json b/data/2026/CVE-2026-111000.json index 2dbbd4c133..43f4f21db5 100644 --- a/data/2026/CVE-2026-111000.json +++ b/data/2026/CVE-2026-111000.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThan":"13.0.10","status":"affected","version":"13.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThan":"13.0.10","status":"affected","version":"13.0.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management)."}],"id":"CVE-2026-111000","lastModified":"2026-11-11T15:17:14.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:14.503","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-111000"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}],"source":"security@grafana.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThan":"13.0.10","status":"affected","version":"13.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThan":"13.0.10","status":"affected","version":"13.0.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management)."}],"id":"CVE-2026-111000","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:14.503","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-111000"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111024.json b/data/2026/CVE-2026-111024.json index 128e7db705..371d93920d 100644 --- a/data/2026/CVE-2026-111024.json +++ b/data/2026/CVE-2026-111024.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.2","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.2","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization)."}],"id":"CVE-2026-111024","lastModified":"2026-11-11T15:17:14.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:14.630","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-111024"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-636"},{"lang":"en","value":"CWE-863"}],"source":"security@grafana.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.2","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.2","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization)."}],"id":"CVE-2026-111024","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:14.630","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-111024"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-636"},{"lang":"en","value":"CWE-863"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111036.json b/data/2026/CVE-2026-111036.json index 00abf1acd9..5c8e047c43 100644 --- a/data/2026/CVE-2026-111036.json +++ b/data/2026/CVE-2026-111036.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Coupa Total Spend Management Platform","vendor":"Coupa","versions":[{"lessThan":"04/11/2024","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services."}],"id":"CVE-2026-111036","lastModified":"2026-11-09T22:18:23.673","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:16:03.241322Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:24.770","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Coupa Total Spend Management Platform","vendor":"Coupa","versions":[{"lessThan":"04/11/2024","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services."}],"id":"CVE-2026-111036","lastModified":"2026-11-12T17:34:53.077","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:16:03.241322Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:24.770","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111037.json b/data/2026/CVE-2026-111037.json index 266b1fbd55..cfc296d814 100644 --- a/data/2026/CVE-2026-111037.json +++ b/data/2026/CVE-2026-111037.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Coupa Total Spend Management Platform","vendor":"Coupa","versions":[{"lessThan":"04/11/2026","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim’s browser. A successful exploit could allow the attacker to perform actions on the victim’s behalf, disclose accessible information or manipulate the user interface."}],"id":"CVE-2026-111037","lastModified":"2026-11-09T22:18:23.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111037","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:15:26.398094Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:24.927","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Coupa Total Spend Management Platform","vendor":"Coupa","versions":[{"lessThan":"04/11/2026","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim’s browser. A successful exploit could allow the attacker to perform actions on the victim’s behalf, disclose accessible information or manipulate the user interface."}],"id":"CVE-2026-111037","lastModified":"2026-11-12T17:35:11.940","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111037","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:15:26.398094Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:24.927","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111038.json b/data/2026/CVE-2026-111038.json index 324cecd5eb..947d419e28 100644 --- a/data/2026/CVE-2026-111038.json +++ b/data/2026/CVE-2026-111038.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Coupa Total Spend Management Platform","vendor":"Coupa","versions":[{"lessThan":"04/11/2026","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context."}],"id":"CVE-2026-111038","lastModified":"2026-11-09T22:18:23.960","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111038","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:14:51.075782Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:25.070","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1236"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Coupa Total Spend Management Platform","vendor":"Coupa","versions":[{"lessThan":"04/11/2026","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context."}],"id":"CVE-2026-111038","lastModified":"2026-11-12T17:35:32.337","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111038","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:14:51.075782Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:25.070","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1236"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111040.json b/data/2026/CVE-2026-111040.json index d79e988e2c..f63e89dca6 100644 --- a/data/2026/CVE-2026-111040.json +++ b/data/2026/CVE-2026-111040.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Coupa Total Spend Management Platform","vendor":"Coupa","versions":[{"lessThan":"04/11/2026","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application."}],"id":"CVE-2026-111040","lastModified":"2026-11-09T22:18:24.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111040","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:14:19.470774Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:25.220","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Coupa Total Spend Management Platform","vendor":"Coupa","versions":[{"lessThan":"04/11/2026","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application."}],"id":"CVE-2026-111040","lastModified":"2026-11-12T17:36:27.810","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111040","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:14:19.470774Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:25.220","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111239.json b/data/2026/CVE-2026-111239.json index 9427728640..47144a822e 100644 --- a/data/2026/CVE-2026-111239.json +++ b/data/2026/CVE-2026-111239.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-ssh","packageURL":"pkg:maven/org.apache.openejb/openejb-ssh","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-ssh","packageURL":"pkg:maven/org.apache.tomee/openejb-ssh","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-common-cli","packageURL":"pkg:maven/org.apache.openejb/openejb-common-cli","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-common-cli","packageURL":"pkg:maven/org.apache.tomee/openejb-common-cli","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users."}],"id":"CVE-2026-111239","lastModified":"2026-11-11T11:17:11.013","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:16.551793Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:14.597","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/wfoxj510yol03lmzbzdftyphwvtq87wg"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-ssh","packageURL":"pkg:maven/org.apache.openejb/openejb-ssh","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-ssh","packageURL":"pkg:maven/org.apache.tomee/openejb-ssh","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-common-cli","packageURL":"pkg:maven/org.apache.openejb/openejb-common-cli","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-common-cli","packageURL":"pkg:maven/org.apache.tomee/openejb-common-cli","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users."}],"id":"CVE-2026-111239","lastModified":"2026-11-12T17:06:26.857","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:16.551793Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:14.597","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/wfoxj510yol03lmzbzdftyphwvtq87wg"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111240.json b/data/2026/CVE-2026-111240.json index 0b066e4688..13f3ea46b8 100644 --- a/data/2026/CVE-2026-111240.json +++ b/data/2026/CVE-2026-111240.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111240","lastModified":"2026-11-10T16:17:14.723","metrics":{},"published":"2026-11-10T16:17:14.723","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/1w1olwsbzpsj7mnv8v3vj30ohq0t0c52"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111240","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:14.723","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/1w1olwsbzpsj7mnv8v3vj30ohq0t0c52"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111241.json b/data/2026/CVE-2026-111241.json index 8deb900595..6ebbdf375b 100644 --- a/data/2026/CVE-2026-111241.json +++ b/data/2026/CVE-2026-111241.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that directory can read passivated session state or supply data that the server deserializes, potentially leading to code execution as the server process. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111241","lastModified":"2026-11-10T16:17:14.840","metrics":{},"published":"2026-11-10T16:17:14.840","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/kbpc7t241483pnxo2sccrhyp6pjkwbq2"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-377"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that directory can read passivated session state or supply data that the server deserializes, potentially leading to code execution as the server process. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111241","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:14.840","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/kbpc7t241483pnxo2sccrhyp6pjkwbq2"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-377"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111242.json b/data/2026/CVE-2026-111242.json index 21dcad0c22..be66d98521 100644 --- a/data/2026/CVE-2026-111242.json +++ b/data/2026/CVE-2026-111242.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:mp-jwt","packageURL":"pkg:maven/org.apache.tomee/mp-jwt","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"8.0.0-M2","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111242","lastModified":"2026-11-10T16:17:14.967","metrics":{},"published":"2026-11-10T16:17:14.967","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/opr1oob7p8xtqwcj1yv2dnsj4zqo9f03"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-488"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:mp-jwt","packageURL":"pkg:maven/org.apache.tomee/mp-jwt","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"8.0.0-M2","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111242","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:14.967","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/opr1oob7p8xtqwcj1yv2dnsj4zqo9f03"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-488"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111243.json b/data/2026/CVE-2026-111243.json index 839910fe74..642e8887be 100644 --- a/data/2026/CVE-2026-111243.json +++ b/data/2026/CVE-2026-111243.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:mp-jwt","packageURL":"pkg:maven/org.apache.tomee/mp-jwt","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111243","lastModified":"2026-11-10T16:17:15.080","metrics":{},"published":"2026-11-10T16:17:15.080","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/zb9sshs1fhz72llk3bb20ksw50n9jhqp"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:mp-jwt","packageURL":"pkg:maven/org.apache.tomee/mp-jwt","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111243","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:15.080","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/zb9sshs1fhz72llk3bb20ksw50n9jhqp"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111244.json b/data/2026/CVE-2026-111244.json index b5a85a4994..e7de915515 100644 --- a/data/2026/CVE-2026-111244.json +++ b/data/2026/CVE-2026-111244.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:mp-jwt","packageURL":"pkg:maven/org.apache.tomee/mp-jwt","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.1.0","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111244","lastModified":"2026-11-10T16:17:15.203","metrics":{},"published":"2026-11-10T16:17:15.203","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/flpx4mgmzqx36fm6gy3thcoh74b5yz7o"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:mp-jwt","packageURL":"pkg:maven/org.apache.tomee/mp-jwt","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.1.0","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111244","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:15.203","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/flpx4mgmzqx36fm6gy3thcoh74b5yz7o"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111245.json b/data/2026/CVE-2026-111245.json index d8e43ab742..b65e358126 100644 --- a/data/2026/CVE-2026-111245.json +++ b/data/2026/CVE-2026-111245.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-cxf","packageURL":"pkg:maven/org.apache.openejb/openejb-cxf","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-cxf","packageURL":"pkg:maven/org.apache.tomee/openejb-cxf","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111245","lastModified":"2026-11-10T16:17:15.313","metrics":{},"published":"2026-11-10T16:17:15.313","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/6nr7gp3kxf919mhv2o0yg45t310x5go8"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-488"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-cxf","packageURL":"pkg:maven/org.apache.openejb/openejb-cxf","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-cxf","packageURL":"pkg:maven/org.apache.tomee/openejb-cxf","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111245","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:15.313","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/6nr7gp3kxf919mhv2o0yg45t310x5go8"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-488"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111246.json b/data/2026/CVE-2026-111246.json index 2bc6bb14c9..ac2121aed9 100644 --- a/data/2026/CVE-2026-111246.json +++ b/data/2026/CVE-2026-111246.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-http","packageURL":"pkg:maven/org.apache.openejb/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.5.2","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-111246","lastModified":"2026-11-10T16:17:15.457","metrics":{},"published":"2026-11-10T16:17:15.457","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/3l9twg2ywvgwjffv4wwop2fmtp05fp39"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-668"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-http","packageURL":"pkg:maven/org.apache.openejb/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.5.2","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-111246","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:15.457","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/3l9twg2ywvgwjffv4wwop2fmtp05fp39"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-668"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111247.json b/data/2026/CVE-2026-111247.json index 7552309f34..2899288c30 100644 --- a/data/2026/CVE-2026-111247.json +++ b/data/2026/CVE-2026-111247.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-catalina","packageURL":"pkg:maven/org.apache.tomee/tomee-catalina","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"8.0.7","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111247","lastModified":"2026-11-10T16:17:15.577","metrics":{},"published":"2026-11-10T16:17:15.577","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/wmx75ytmp7d5h8cnd8jf1lg2gbw983f3"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-catalina","packageURL":"pkg:maven/org.apache.tomee/tomee-catalina","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"8.0.7","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111247","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:15.577","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/wmx75ytmp7d5h8cnd8jf1lg2gbw983f3"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111248.json b/data/2026/CVE-2026-111248.json index 0c7a2b965e..8cf35791b8 100644 --- a/data/2026/CVE-2026-111248.json +++ b/data/2026/CVE-2026-111248.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-security","packageURL":"pkg:maven/org.apache.tomee/tomee-security","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"8.0.0-M2","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111248","lastModified":"2026-11-10T16:17:15.703","metrics":{},"published":"2026-11-10T16:17:15.703","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/47svr3bg4lchzlhkl55g5bfykhnx48jo"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-836"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-security","packageURL":"pkg:maven/org.apache.tomee/tomee-security","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"8.0.0-M2","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111248","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:15.703","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/47svr3bg4lchzlhkl55g5bfykhnx48jo"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-836"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111249.json b/data/2026/CVE-2026-111249.json index f12935a6f3..8beeb9d285 100644 --- a/data/2026/CVE-2026-111249.json +++ b/data/2026/CVE-2026-111249.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:livereload-tomee","packageURL":"pkg:maven/org.apache.tomee/livereload-tomee","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M2","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111249","lastModified":"2026-11-10T16:17:15.830","metrics":{},"published":"2026-11-10T16:17:15.830","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/sssq84vj136dz964j1ooyr20jc9s6pnm"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1327"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:livereload-tomee","packageURL":"pkg:maven/org.apache.tomee/livereload-tomee","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M2","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111249","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:15.830","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/sssq84vj136dz964j1ooyr20jc9s6pnm"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1327"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111250.json b/data/2026/CVE-2026-111250.json index 2d1c0b1566..d0fa15e2ba 100644 --- a/data/2026/CVE-2026-111250.json +++ b/data/2026/CVE-2026-111250.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-http","packageURL":"pkg:maven/org.apache.openejb/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-111250","lastModified":"2026-11-10T16:17:15.970","metrics":{},"published":"2026-11-10T16:17:15.970","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/yr5sbbmyym2zfoho8qv3yxshoztqjk6k"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-http","packageURL":"pkg:maven/org.apache.openejb/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-111250","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:15.970","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/yr5sbbmyym2zfoho8qv3yxshoztqjk6k"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111251.json b/data/2026/CVE-2026-111251.json index 340cdfc127..1db8ef0be5 100644 --- a/data/2026/CVE-2026-111251.json +++ b/data/2026/CVE-2026-111251.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-server","packageURL":"pkg:maven/org.apache.openejb/openejb-server","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-server","packageURL":"pkg:maven/org.apache.tomee/openejb-server","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111251","lastModified":"2026-11-10T16:17:16.100","metrics":{},"published":"2026-11-10T16:17:16.100","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/btc4jq3k20xysf7kqsyyt7jg74v8768s"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-server","packageURL":"pkg:maven/org.apache.openejb/openejb-server","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-server","packageURL":"pkg:maven/org.apache.tomee/openejb-server","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111251","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:16.100","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/btc4jq3k20xysf7kqsyyt7jg74v8768s"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111256.json b/data/2026/CVE-2026-111256.json index f2a8d8ccc5..94ffeb3e61 100644 --- a/data/2026/CVE-2026-111256.json +++ b/data/2026/CVE-2026-111256.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-webservices","packageURL":"pkg:maven/org.apache.openejb/openejb-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-rest","packageURL":"pkg:maven/org.apache.openejb/openejb-rest","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.6.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-webservices","packageURL":"pkg:maven/org.apache.tomee/openejb-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-rest","packageURL":"pkg:maven/org.apache.tomee/openejb-rest","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-111256","lastModified":"2026-11-10T16:17:16.217","metrics":{},"published":"2026-11-10T16:17:16.217","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/pfspkd8c0d5pxx3k04vnfvrn979tz1zo"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-webservices","packageURL":"pkg:maven/org.apache.openejb/openejb-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-rest","packageURL":"pkg:maven/org.apache.openejb/openejb-rest","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.6.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-webservices","packageURL":"pkg:maven/org.apache.tomee/openejb-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-rest","packageURL":"pkg:maven/org.apache.tomee/openejb-rest","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-111256","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:16.217","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/pfspkd8c0d5pxx3k04vnfvrn979tz1zo"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111257.json b/data/2026/CVE-2026-111257.json index 1383848e58..5ee1eb0c6a 100644 --- a/data/2026/CVE-2026-111257.json +++ b/data/2026/CVE-2026-111257.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:tomee-catalina","packageURL":"pkg:maven/org.apache.openejb/tomee-catalina","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.7.5","status":"affected","version":"1.5.1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-catalina","packageURL":"pkg:maven/org.apache.tomee/tomee-catalina","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111257","lastModified":"2026-11-10T16:17:16.343","metrics":{},"published":"2026-11-10T16:17:16.343","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/gzzn7jbzrfk8bo9ttmqhr3c6q3szc5vf"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:tomee-catalina","packageURL":"pkg:maven/org.apache.openejb/tomee-catalina","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.7.5","status":"affected","version":"1.5.1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-catalina","packageURL":"pkg:maven/org.apache.tomee/tomee-catalina","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111257","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:16.343","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/gzzn7jbzrfk8bo9ttmqhr3c6q3szc5vf"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111258.json b/data/2026/CVE-2026-111258.json index 5ed93d34a2..8b96d47479 100644 --- a/data/2026/CVE-2026-111258.json +++ b/data/2026/CVE-2026-111258.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:tomee-catalina","packageURL":"pkg:maven/org.apache.openejb/tomee-catalina","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.7.5","status":"affected","version":"1.5.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-catalina","packageURL":"pkg:maven/org.apache.tomee/tomee-catalina","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111258","lastModified":"2026-11-10T16:17:16.460","metrics":{},"published":"2026-11-10T16:17:16.460","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/tr1mxp3vjk3zvc3k45ocz52ctg7wng9m"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:tomee-catalina","packageURL":"pkg:maven/org.apache.openejb/tomee-catalina","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.7.5","status":"affected","version":"1.5.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-catalina","packageURL":"pkg:maven/org.apache.tomee/tomee-catalina","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111258","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:16.460","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/tr1mxp3vjk3zvc3k45ocz52ctg7wng9m"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111259.json b/data/2026/CVE-2026-111259.json index 3a116e7f58..0c8db74e1e 100644 --- a/data/2026/CVE-2026-111259.json +++ b/data/2026/CVE-2026-111259.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-embedded","packageURL":"pkg:maven/org.apache.tomee/tomee-embedded","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111259","lastModified":"2026-11-10T16:17:16.590","metrics":{},"published":"2026-11-10T16:17:16.590","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/1sk4193kxtf18q2so25c62c2b73o94lg"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-338"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-embedded","packageURL":"pkg:maven/org.apache.tomee/tomee-embedded","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111259","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:16.590","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/1sk4193kxtf18q2so25c62c2b73o94lg"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-338"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111260.json b/data/2026/CVE-2026-111260.json index 2f50ad82a6..f95834b1c7 100644 --- a/data/2026/CVE-2026-111260.json +++ b/data/2026/CVE-2026-111260.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-security","packageURL":"pkg:maven/org.apache.tomee/tomee-security","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M2","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111260","lastModified":"2026-11-10T16:17:16.707","metrics":{},"published":"2026-11-10T16:17:16.707","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/y6oscfyggkdf5hrj518nl08v7l8rr40q"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-338"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-security","packageURL":"pkg:maven/org.apache.tomee/tomee-security","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M2","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111260","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:16.707","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/y6oscfyggkdf5hrj518nl08v7l8rr40q"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-338"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111261.json b/data/2026/CVE-2026-111261.json index 6a8d808a41..280568dd97 100644 --- a/data/2026/CVE-2026-111261.json +++ b/data/2026/CVE-2026-111261.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-security","packageURL":"pkg:maven/org.apache.tomee/tomee-security","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"8.0.4","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111261","lastModified":"2026-11-10T16:17:16.820","metrics":{},"published":"2026-11-10T16:17:16.820","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/8dfmrhg064j5btmfs3mwclnw88bdqrt7"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-security","packageURL":"pkg:maven/org.apache.tomee/tomee-security","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"8.0.4","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111261","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:16.820","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/8dfmrhg064j5btmfs3mwclnw88bdqrt7"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111262.json b/data/2026/CVE-2026-111262.json index 94d13f46d9..89919700e8 100644 --- a/data/2026/CVE-2026-111262.json +++ b/data/2026/CVE-2026-111262.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-security","packageURL":"pkg:maven/org.apache.tomee/tomee-security","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"8.0.4","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111262","lastModified":"2026-11-10T15:17:12.000","metrics":{},"published":"2026-11-10T15:17:12.000","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/qrfq68g2znq773z7g960qsckldvtkqzd"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-90"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-security","packageURL":"pkg:maven/org.apache.tomee/tomee-security","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"8.0.4","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111262","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T15:17:12.000","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/qrfq68g2znq773z7g960qsckldvtkqzd"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-90"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111263.json b/data/2026/CVE-2026-111263.json index 32cf5300bf..709275452a 100644 --- a/data/2026/CVE-2026-111263.json +++ b/data/2026/CVE-2026-111263.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:tomee-webservices","packageURL":"pkg:maven/org.apache.openejb/tomee-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.0.0","status":"affected","version":"4.0.0-beta-1","versionType":"semver"},{"lessThanOrEqual":"1.7.5","status":"affected","version":"1.5.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-webservices","packageURL":"pkg:maven/org.apache.tomee/tomee-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its own web.xml security constraints or EJB method permissions. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111263","lastModified":"2026-11-10T15:17:12.130","metrics":{},"published":"2026-11-10T15:17:12.130","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/bgk825mdkyxfrlnbfszmlmbwmlk1qlhl"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:tomee-webservices","packageURL":"pkg:maven/org.apache.openejb/tomee-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.0.0","status":"affected","version":"4.0.0-beta-1","versionType":"semver"},{"lessThanOrEqual":"1.7.5","status":"affected","version":"1.5.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-webservices","packageURL":"pkg:maven/org.apache.tomee/tomee-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its own web.xml security constraints or EJB method permissions. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111263","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T15:17:12.130","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/bgk825mdkyxfrlnbfszmlmbwmlk1qlhl"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111264.json b/data/2026/CVE-2026-111264.json index 89968db627..9380e86c59 100644 --- a/data/2026/CVE-2026-111264.json +++ b/data/2026/CVE-2026-111264.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:tomee-webservices","packageURL":"pkg:maven/org.apache.openejb/tomee-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.0.0","status":"affected","version":"4.0.0-beta-1","versionType":"semver"},{"lessThanOrEqual":"1.7.5","status":"affected","version":"1.5.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-webservices","packageURL":"pkg:maven/org.apache.tomee/tomee-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111264","lastModified":"2026-11-10T15:17:12.253","metrics":{},"published":"2026-11-10T15:17:12.253","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/tldxh492p71z2rlw7g4l1vplrxo5n116"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:tomee-webservices","packageURL":"pkg:maven/org.apache.openejb/tomee-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.0.0","status":"affected","version":"4.0.0-beta-1","versionType":"semver"},{"lessThanOrEqual":"1.7.5","status":"affected","version":"1.5.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:tomee-webservices","packageURL":"pkg:maven/org.apache.tomee/tomee-webservices","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-111264","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T15:17:12.253","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/tldxh492p71z2rlw7g4l1vplrxo5n116"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111456.json b/data/2026/CVE-2026-111456.json new file mode 100644 index 0000000000..6f5288b1b0 --- /dev/null +++ b/data/2026/CVE-2026-111456.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate does not go through that check. A low-privileged network attacker or user who has a valid consumer certificate for one organization can register a new consumer in a different organization by supplying that organization's key. The response includes an identity certificate for the new consumer. With that certificate, the attacker can view the target organization's subscription pools. When the organization is not using simple content access, the attacker can attach that organization's entitlements to the new consumer."}],"id":"CVE-2026-111456","lastModified":"2026-11-12T20:18:16.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T20:18:16.067","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-111456"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553939"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111521.json b/data/2026/CVE-2026-111521.json index 1ae805b1a2..b54741d62a 100644 --- a/data/2026/CVE-2026-111521.json +++ b/data/2026/CVE-2026-111521.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Display and Peripheral Manager (DDPM Windows)","vendor":"Dell","versions":[{"lessThan":"2.4.0.17","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution."}],"id":"CVE-2026-111521","lastModified":"2026-11-11T22:17:10.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T22:17:10.820","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527625/dsa-2026-482-security-update-for-dell-display-and-peripheral-manager-ddpm-windows-for-a-time-of-check-time-of-use-toctou-vulnerability"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Display and Peripheral Manager (DDPM Windows)","vendor":"Dell","versions":[{"lessThan":"2.4.0.17","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution."}],"id":"CVE-2026-111521","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T22:17:10.820","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527625/dsa-2026-482-security-update-for-dell-display-and-peripheral-manager-ddpm-windows-for-a-time-of-check-time-of-use-toctou-vulnerability"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security_alert@emc.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111552.json b/data/2026/CVE-2026-111552.json index c7839bccdd..9f8f12804a 100644 --- a/data/2026/CVE-2026-111552.json +++ b/data/2026/CVE-2026-111552.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure - dealer integration","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure - Storefront application and management panel","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"2.1796","status":"affected","version":"0","versionType":"custom"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Authentication Bypass.\n\nThis issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796."}],"id":"CVE-2026-111552","lastModified":"2026-11-12T13:17:09.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-12T13:17:09.637","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1531"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-308"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"1.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure - dealer integration","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"1.2","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Hyper E-Commerce Infrastructure - Storefront application and management panel","vendor":"Hyper Teknoloji Ltd. Şti.","versions":[{"lessThan":"2.1796","status":"affected","version":"0","versionType":"custom"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Authentication Bypass.\n\nThis issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796."}],"id":"CVE-2026-111552","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-12T13:17:09.637","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1531"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-308"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111579.json b/data/2026/CVE-2026-111579.json index 7ab1b4db13..ae18423877 100644 --- a/data/2026/CVE-2026-111579.json +++ b/data/2026/CVE-2026-111579.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Forminator Forms","vendor":"Unknown","versions":[{"lessThan":"1.58.4","status":"affected","version":"1.58.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, up to administrator, after the gateway has been connected and later disconnected."}],"id":"CVE-2026-111579","lastModified":"2026-11-11T12:18:35.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:26:21.571432Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.617","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/c490b47f-4898-4323-8bec-e32bc7732d1d/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Forminator Forms","vendor":"Unknown","versions":[{"lessThan":"1.58.4","status":"affected","version":"1.58.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, up to administrator, after the gateway has been connected and later disconnected."}],"id":"CVE-2026-111579","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:26:21.571432Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.617","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/c490b47f-4898-4323-8bec-e32bc7732d1d/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111597.json b/data/2026/CVE-2026-111597.json index 897e0a1a68..a364f5e5c3 100644 --- a/data/2026/CVE-2026-111597.json +++ b/data/2026/CVE-2026-111597.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Forminator Forms","vendor":"Unknown","versions":[{"lessThan":"1.58.4","status":"affected","version":"1.58.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying."}],"id":"CVE-2026-111597","lastModified":"2026-11-11T12:18:35.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111597","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:59.988846Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.740","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/10aa446f-3664-4deb-ace6-01d5c47d7103/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Forminator Forms","vendor":"Unknown","versions":[{"lessThan":"1.58.4","status":"affected","version":"1.58.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying."}],"id":"CVE-2026-111597","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111597","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:59.988846Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:11.740","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/10aa446f-3664-4deb-ace6-01d5c47d7103/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111729.json b/data/2026/CVE-2026-111729.json index d61ea985a3..8a22dc1c76 100644 --- a/data/2026/CVE-2026-111729.json +++ b/data/2026/CVE-2026-111729.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"0.7.0","versionType":"custom"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Kura versions <= 5.6.2, the \"Command\" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured `command.working.directory`. The path-containment check `validateFileName()` compares canonical paths with `String.startsWith()` without appending a trailing path separator, so an entry that canonicalises to a sibling directory sharing the same string prefix (e.g. `/tmpevil/x` when the intended directory is `/tmp`) is accepted. The handler then calls `parent.mkdirs()` and `new FileOutputStream(newFile)`, creating directories and writing attacker-controlled bytes outside the intended extraction root.\n\n\n\nThe command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. The caller must be authenticated with `rest.command` permission."}],"id":"CVE-2026-111729","lastModified":"2026-11-10T17:17:20.353","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T17:17:20.353","references":[{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/428"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/958"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"0.7.0","versionType":"custom"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Kura versions <= 5.6.2, the \"Command\" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured `command.working.directory`. The path-containment check `validateFileName()` compares canonical paths with `String.startsWith()` without appending a trailing path separator, so an entry that canonicalises to a sibling directory sharing the same string prefix (e.g. `/tmpevil/x` when the intended directory is `/tmp`) is accepted. The handler then calls `parent.mkdirs()` and `new FileOutputStream(newFile)`, creating directories and writing attacker-controlled bytes outside the intended extraction root.\n\n\n\nThe command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled. The caller must be authenticated with `rest.command` permission."}],"id":"CVE-2026-111729","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T17:17:20.353","references":[{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/428"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/958"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111751.json b/data/2026/CVE-2026-111751.json index bddcd3e4fa..aceba99cd6 100644 --- a/data/2026/CVE-2026-111751.json +++ b/data/2026/CVE-2026-111751.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"angular","vendor":"angular","versions":[{"status":"affected","version":">= 21.2.0, < 21.2.25"},{"status":"affected","version":">= 22.0.0, < 22.2.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1."}],"id":"CVE-2026-111751","lastModified":"2026-11-07T04:17:11.417","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111751","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:34:14.998231Z","version":"2.0.3"}}]},"published":"2026-11-03T21:16:57.800","references":[{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/70908"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/70953"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v21.2.25"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v22.2.1"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"angular","vendor":"angular","versions":[{"status":"affected","version":">= 21.2.0, < 21.2.25"},{"status":"affected","version":">= 22.0.0, < 22.2.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1."}],"id":"CVE-2026-111751","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111751","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:34:14.998231Z","version":"2.0.3"}}]},"published":"2026-11-03T21:16:57.800","references":[{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/70908"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/70953"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v21.2.25"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v22.2.1"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111752.json b/data/2026/CVE-2026-111752.json index 5cfda056a1..2081516465 100644 --- a/data/2026/CVE-2026-111752.json +++ b/data/2026/CVE-2026-111752.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"angular","vendor":"angular","versions":[{"status":"affected","version":"<= 19.2.25"},{"status":"affected","version":">= 20.0.0, < 20.3.33"},{"status":"affected","version":">= 21.0.0, < 21.2.25"},{"status":"affected","version":">= 22.0.0, < 22.2.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1."}],"id":"CVE-2026-111752","lastModified":"2026-11-09T16:17:25.570","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111752","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:49:59.445156Z","version":"2.0.3"}}]},"published":"2026-11-03T21:16:57.993","references":[{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/70932"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/70997"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71055"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v20.3.33"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v21.2.25"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v22.2.1"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-405"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"angular","vendor":"angular","versions":[{"status":"affected","version":"<= 19.2.25"},{"status":"affected","version":">= 20.0.0, < 20.3.33"},{"status":"affected","version":">= 21.0.0, < 21.2.25"},{"status":"affected","version":">= 22.0.0, < 22.2.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1."}],"id":"CVE-2026-111752","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111752","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:49:59.445156Z","version":"2.0.3"}}]},"published":"2026-11-03T21:16:57.993","references":[{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/70932"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/70997"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71055"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v20.3.33"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v21.2.25"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v22.2.1"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-405"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111754.json b/data/2026/CVE-2026-111754.json index af73f178b8..e2f9dfffe2 100644 --- a/data/2026/CVE-2026-111754.json +++ b/data/2026/CVE-2026-111754.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"angular","vendor":"angular","versions":[{"status":"affected","version":"<= 19.2.25"},{"status":"affected","version":">= 20.0.0, < 20.3.33"},{"status":"affected","version":">= 21.0.0, < 21.2.25"},{"status":"affected","version":">= 22.0.0, < 22.2.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1."}],"id":"CVE-2026-111754","lastModified":"2026-11-03T22:17:44.523","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111754","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T21:23:29.234599Z","version":"2.0.3"}}]},"published":"2026-11-03T21:16:58.203","references":[{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/71076"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71077"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71078"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71079"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v20.3.33"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v21.2.25"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v22.2.1"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"angular","vendor":"angular","versions":[{"status":"affected","version":"<= 19.2.25"},{"status":"affected","version":">= 20.0.0, < 20.3.33"},{"status":"affected","version":">= 21.0.0, < 21.2.25"},{"status":"affected","version":">= 22.0.0, < 22.2.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1."}],"id":"CVE-2026-111754","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111754","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T21:23:29.234599Z","version":"2.0.3"}}]},"published":"2026-11-03T21:16:58.203","references":[{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/71076"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71077"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71078"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71079"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v20.3.33"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v21.2.25"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v22.2.1"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111770.json b/data/2026/CVE-2026-111770.json index 06fceadf5a..12bf65cd74 100644 --- a/data/2026/CVE-2026-111770.json +++ b/data/2026/CVE-2026-111770.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":"< 1.32.0"}]},{"product":"server","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients could deliver responses and notifications to the wrong client. The affected surface is an MCP server reached over HTTP by multiple clients. The trigger is reuse of one stateless transport or server instance. Messages were associated with a connection using only the JSON-RPC request identifier. SDK clients start request identifiers at zero, so collisions occur in normal operation. Cross-client delivery exposes one client's responses and notifications to another client. The issue requires an HTTP endpoint reachable by more than one client and an application that constructs the server or transport once at startup instead of once per request or session. stdio servers and factory-created per-call servers are not affected. Upgrading causes reused instances to fail and therefore requires an application code change. This issue is fixed in @modelcontextprotocol/server 2.3.0."}],"id":"CVE-2026-111770","lastModified":"2026-11-05T22:17:45.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111770","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:44:38.294653Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:45.817","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2918"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":"< 1.32.0"}]},{"product":"server","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients could deliver responses and notifications to the wrong client. The affected surface is an MCP server reached over HTTP by multiple clients. The trigger is reuse of one stateless transport or server instance. Messages were associated with a connection using only the JSON-RPC request identifier. SDK clients start request identifiers at zero, so collisions occur in normal operation. Cross-client delivery exposes one client's responses and notifications to another client. The issue requires an HTTP endpoint reachable by more than one client and an application that constructs the server or transport once at startup instead of once per request or session. stdio servers and factory-created per-call servers are not affected. Upgrading causes reused instances to fail and therefore requires an application code change. This issue is fixed in @modelcontextprotocol/server 2.3.0."}],"id":"CVE-2026-111770","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111770","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:44:38.294653Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:45.817","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/84804c22e45a662675a198f853b7f00063838a8d"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2918"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-111792.json b/data/2026/CVE-2026-111792.json index a92fb3d760..b872ccb5f7 100644 --- a/data/2026/CVE-2026-111792.json +++ b/data/2026/CVE-2026-111792.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-bridge","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-bridge","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Recursion vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-111792","lastModified":"2026-11-11T19:17:29.240","metrics":{},"published":"2026-11-11T11:17:11.147","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/BATIK-1397"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/dn70ltz1o9sg88dd87wcyh4v73fk2tnm"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/14"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-bridge","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-bridge","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Recursion vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-111792","lastModified":"2026-11-12T17:01:06.913","metrics":{},"published":"2026-11-11T11:17:11.147","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/BATIK-1397"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/dn70ltz1o9sg88dd87wcyh4v73fk2tnm"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/14"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111824.json b/data/2026/CVE-2026-111824.json index 788c097d4f..61790e6c6e 100644 --- a/data/2026/CVE-2026-111824.json +++ b/data/2026/CVE-2026-111824.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"status":"affected","version":"6.1.6","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for CVE-2026-82387 serves uploaded media as a download unless it is an image, audio, video, PDF or plain text, but media files found through a custom theme were served with the type their path implies, and the upload form let the uploader choose that path. Media uploads are disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which serves these files under the same rules as other media and no longer accepts the path from the upload form."}],"id":"CVE-2026-111824","lastModified":"2026-11-11T13:17:13.730","metrics":{},"published":"2026-11-11T13:17:13.730","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/217"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/q0lbzt39tsosb99l25gqvx24d6fn263x"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"status":"affected","version":"6.1.6","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for CVE-2026-82387 serves uploaded media as a download unless it is an image, audio, video, PDF or plain text, but media files found through a custom theme were served with the type their path implies, and the upload form let the uploader choose that path. Media uploads are disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which serves these files under the same rules as other media and no longer accepts the path from the upload form."}],"id":"CVE-2026-111824","lastModified":"2026-11-12T16:59:32.603","metrics":{},"published":"2026-11-11T13:17:13.730","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/217"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/q0lbzt39tsosb99l25gqvx24d6fn263x"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-112072.json b/data/2026/CVE-2026-112072.json index 1283d5a1e5..089332da58 100644 --- a/data/2026/CVE-2026-112072.json +++ b/data/2026/CVE-2026-112072.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"io.github.jopenlibs:vault-java-driver","product":"vault-java-driver","programFiles":["src/main/java/io/github/jopenlibs/vault/json/JsonParser.java"],"repo":"https://github.com/jopenlibs/vault-java-driver","vendor":"jopenlibs","versions":[{"lessThan":"7.0.0","status":"affected","version":"5.2.0","versionType":"maven"}]}],"source":"abd028dc-c042-4c4d-9749-38d0f850af89"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0."}],"id":"CVE-2026-112072","lastModified":"2026-11-05T19:17:09.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"abd028dc-c042-4c4d-9749-38d0f850af89","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:41:01.431970Z","version":"2.0.3"}}]},"published":"2026-11-05T08:17:03.663","references":[{"source":"abd028dc-c042-4c4d-9749-38d0f850af89","url":"https://github.com/jopenlibs/vault-java-driver/pull/81"},{"source":"abd028dc-c042-4c4d-9749-38d0f850af89","url":"https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/"}],"sourceIdentifier":"abd028dc-c042-4c4d-9749-38d0f850af89","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"abd028dc-c042-4c4d-9749-38d0f850af89","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"io.github.jopenlibs:vault-java-driver","product":"vault-java-driver","programFiles":["src/main/java/io/github/jopenlibs/vault/json/JsonParser.java"],"repo":"https://github.com/jopenlibs/vault-java-driver","vendor":"jopenlibs","versions":[{"lessThan":"7.0.0","status":"affected","version":"5.2.0","versionType":"maven"}]}],"source":"abd028dc-c042-4c4d-9749-38d0f850af89"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0."}],"id":"CVE-2026-112072","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"abd028dc-c042-4c4d-9749-38d0f850af89","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:41:01.431970Z","version":"2.0.3"}}]},"published":"2026-11-05T08:17:03.663","references":[{"source":"abd028dc-c042-4c4d-9749-38d0f850af89","url":"https://github.com/jopenlibs/vault-java-driver/pull/81"},{"source":"abd028dc-c042-4c4d-9749-38d0f850af89","url":"https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/"}],"sourceIdentifier":"abd028dc-c042-4c4d-9749-38d0f850af89","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"abd028dc-c042-4c4d-9749-38d0f850af89","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112116.json b/data/2026/CVE-2026-112116.json index 583ffb3567..e87a229929 100644 --- a/data/2026/CVE-2026-112116.json +++ b/data/2026/CVE-2026-112116.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"System Control Interface","vendor":"ASUS","versions":[{"lessThanOrEqual":"3.1.69.0","status":"affected","version":"3.1.66.0","versionType":"custom"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complete compromise of the affected system.\nRefer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-112116","lastModified":"2026-11-04T16:17:33.343","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112116","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T14:55:06.580995Z","version":"2.0.3"}}]},"published":"2026-11-04T02:17:14.953","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-782"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"System Control Interface","vendor":"ASUS","versions":[{"lessThanOrEqual":"3.1.69.0","status":"affected","version":"3.1.66.0","versionType":"custom"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complete compromise of the affected system.\nRefer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-112116","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112116","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T14:55:06.580995Z","version":"2.0.3"}}]},"published":"2026-11-04T02:17:14.953","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-782"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112164.json b/data/2026/CVE-2026-112164.json index 730d519f57..2bc5f60943 100644 --- a/data/2026/CVE-2026-112164.json +++ b/data/2026/CVE-2026-112164.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["iOS","Android"],"product":"lasergest","vendor":"laservideo","versions":[{"status":"affected","version":"1.0.18","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext."}],"id":"CVE-2026-112164","lastModified":"2026-11-09T18:17:20.133","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112164","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:22:53.695838Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:09.583","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://github.com/livieromarco/security-advisories/blob/main/advisories/CVE-2026-112164.md"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"},{"lang":"en","value":"CWE-522"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["iOS","Android"],"product":"lasergest","vendor":"laservideo","versions":[{"status":"affected","version":"1.0.18","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext."}],"id":"CVE-2026-112164","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112164","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:22:53.695838Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:09.583","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://github.com/livieromarco/security-advisories/blob/main/advisories/CVE-2026-112164.md"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"},{"lang":"en","value":"CWE-522"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112165.json b/data/2026/CVE-2026-112165.json index 54ae158a75..cfba0ffa7e 100644 --- a/data/2026/CVE-2026-112165.json +++ b/data/2026/CVE-2026-112165.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["iOS","Android"],"product":"lasergest","vendor":"laservideo","versions":[{"status":"affected","version":"1.0.18","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode(\"nocheck\"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications."}],"id":"CVE-2026-112165","lastModified":"2026-11-09T17:17:09.720","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112165","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:43:47.582296Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:09.720","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://github.com/livieromarco/security-advisories/blob/main/advisories/CVE-2026-112165.md"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["iOS","Android"],"product":"lasergest","vendor":"laservideo","versions":[{"status":"affected","version":"1.0.18","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode(\"nocheck\"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications."}],"id":"CVE-2026-112165","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112165","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:43:47.582296Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:09.720","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://github.com/livieromarco/security-advisories/blob/main/advisories/CVE-2026-112165.md"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112168.json b/data/2026/CVE-2026-112168.json index e20dc4ba60..8c4a68b778 100644 --- a/data/2026/CVE-2026-112168.json +++ b/data/2026/CVE-2026-112168.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"MAGISTRA","vendor":"GALENO SISTEMI","versions":[{"status":"affected","version":"3.12","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets."}],"id":"CVE-2026-112168","lastModified":"2026-11-09T13:17:04.277","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T13:17:04.277","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-261"},{"lang":"en","value":"CWE-312"},{"lang":"en","value":"CWE-327"},{"lang":"en","value":"CWE-798"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"MAGISTRA","vendor":"GALENO SISTEMI","versions":[{"status":"affected","version":"3.12","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets."}],"id":"CVE-2026-112168","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112168","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:08:32.010633Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:04.277","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-261"},{"lang":"en","value":"CWE-312"},{"lang":"en","value":"CWE-327"},{"lang":"en","value":"CWE-798"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112169.json b/data/2026/CVE-2026-112169.json index d0ccd56a53..1d2f00b644 100644 --- a/data/2026/CVE-2026-112169.json +++ b/data/2026/CVE-2026-112169.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"MAGISTRA","vendor":"GALENO SISTEMI","versions":[{"status":"affected","version":"3.12","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credential verification."}],"id":"CVE-2026-112169","lastModified":"2026-11-09T13:17:04.420","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T13:17:04.420","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"},{"lang":"en","value":"CWE-912"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"MAGISTRA","vendor":"GALENO SISTEMI","versions":[{"status":"affected","version":"3.12","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credential verification."}],"id":"CVE-2026-112169","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:09:08.667343Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:04.420","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"},{"lang":"en","value":"CWE-912"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112170.json b/data/2026/CVE-2026-112170.json index 23117c90b5..b28772b495 100644 --- a/data/2026/CVE-2026-112170.json +++ b/data/2026/CVE-2026-112170.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"MAGISTRA","vendor":"GALENO SISTEMI","versions":[{"status":"affected","version":"3.12","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates."}],"id":"CVE-2026-112170","lastModified":"2026-11-09T13:17:04.560","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T13:17:04.560","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-427"},{"lang":"en","value":"CWE-494"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"MAGISTRA","vendor":"GALENO SISTEMI","versions":[{"status":"affected","version":"3.12","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates."}],"id":"CVE-2026-112170","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112170","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:09:40.820363Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:04.560","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-427"},{"lang":"en","value":"CWE-494"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112171.json b/data/2026/CVE-2026-112171.json index d9837eb135..e5a20c8716 100644 --- a/data/2026/CVE-2026-112171.json +++ b/data/2026/CVE-2026-112171.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"MAGISTRA","vendor":"GALENO SISTEMI","versions":[{"status":"affected","version":"3.12","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosure of database data."}],"id":"CVE-2026-112171","lastModified":"2026-11-09T13:17:04.693","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T13:17:04.693","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"MAGISTRA","vendor":"GALENO SISTEMI","versions":[{"status":"affected","version":"3.12","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosure of database data."}],"id":"CVE-2026-112171","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112171","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:10:14.822736Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:04.693","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-magistra"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112172.json b/data/2026/CVE-2026-112172.json index 83a00ac15d..9c23ebff66 100644 --- a/data/2026/CVE-2026-112172.json +++ b/data/2026/CVE-2026-112172.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XDent","vendor":"CompuGroup Medical","versions":[{"lessThan":"4.4.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"XMedical","vendor":"CompuGroup Medical","versions":[{"lessThan":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases."}],"id":"CVE-2026-112172","lastModified":"2026-11-12T16:17:53.843","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112172","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:48:11.664289Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:35.170","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XDent","vendor":"CompuGroup Medical","versions":[{"lessThan":"4.4.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"XMedical","vendor":"CompuGroup Medical","versions":[{"lessThan":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases."}],"id":"CVE-2026-112172","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112172","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:48:11.664289Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:35.170","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112174.json b/data/2026/CVE-2026-112174.json index 19eddc1adb..7275b5581c 100644 --- a/data/2026/CVE-2026-112174.json +++ b/data/2026/CVE-2026-112174.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Iperius Backup","vendor":"Enter","versions":[{"status":"affected","version":"8.8.3 for Windows"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected Windows system."}],"id":"CVE-2026-112174","lastModified":"2026-11-11T10:16:42.960","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}]},"published":"2026-11-11T10:16:42.960","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-enters-iperius-backup"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"}],"source":"cve-coordination@incibe.es","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Iperius Backup","vendor":"Enter","versions":[{"status":"affected","version":"8.8.3 for Windows"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected Windows system."}],"id":"CVE-2026-112174","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}]},"published":"2026-11-11T10:16:42.960","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-enters-iperius-backup"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"}],"source":"cve-coordination@incibe.es","type":"Primary"}]} diff --git a/data/2026/CVE-2026-112185.json b/data/2026/CVE-2026-112185.json index a34c8a66a6..b2d806f28b 100644 --- a/data/2026/CVE-2026-112185.json +++ b/data/2026/CVE-2026-112185.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"5.1.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not restrict access to the configuration of the UserAdmin persistence component to identities holding the kura.admin permission. An authenticated identity holding only the rest.configuration permission can read the password hashes of all identities, including administrators, which are stored as unsalted SHA-256 digests. The same identity can also modify identities and permission assignments, and restore previous configuration snapshots, which allows escalation to full administrative privileges. The issue is fixed in Eclipse Kura 5.6.3."}],"id":"CVE-2026-112185","lastModified":"2026-11-10T17:17:20.693","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T17:17:20.693","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-gqr7-j252-qwqx"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/430"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"},{"lang":"en","value":"CWE-668"},{"lang":"en","value":"CWE-863"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"5.1.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not restrict access to the configuration of the UserAdmin persistence component to identities holding the kura.admin permission. An authenticated identity holding only the rest.configuration permission can read the password hashes of all identities, including administrators, which are stored as unsalted SHA-256 digests. The same identity can also modify identities and permission assignments, and restore previous configuration snapshots, which allows escalation to full administrative privileges. The issue is fixed in Eclipse Kura 5.6.3."}],"id":"CVE-2026-112185","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T17:17:20.693","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-gqr7-j252-qwqx"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/430"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"},{"lang":"en","value":"CWE-668"},{"lang":"en","value":"CWE-863"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-112186.json b/data/2026/CVE-2026-112186.json index fd57c7f2d7..003c8f0cd8 100644 --- a/data/2026/CVE-2026-112186.json +++ b/data/2026/CVE-2026-112186.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"5.4.0","versionType":"custom"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1."}],"id":"CVE-2026-112186","lastModified":"2026-11-10T17:17:20.850","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T17:17:20.850","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-pwq4-h95h-5634"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/429"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-696"},{"lang":"en","value":"CWE-770"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"5.4.0","versionType":"custom"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an `OutOfMemoryError`, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a `StackOverflowError` because of an unbound recursion in Service Listing V1."}],"id":"CVE-2026-112186","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T17:17:20.850","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-pwq4-h95h-5634"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/429"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-696"},{"lang":"en","value":"CWE-770"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-112191.json b/data/2026/CVE-2026-112191.json index 32d43409b9..a451346d33 100644 --- a/data/2026/CVE-2026-112191.json +++ b/data/2026/CVE-2026-112191.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"5.4.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity holding the rest.identity permission, but not kura.admin, can assign any permission to any identity, including kura.admin to itself. It can also change the password of, or delete, identities holding more privileges than its own, including administrators, and create or delete permissions. This allows escalation to full administrative privileges and can lock legitimate administrators out of the device. The issue is fixed in Eclipse Kura 5.6.3."}],"id":"CVE-2026-112191","lastModified":"2026-11-10T16:17:16.947","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T16:17:16.947","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-v8gf-9w4p-662w"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/431"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"5.4.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0, provided by org.eclipse.kura.rest.identity.provider) do not check identity and permission management requests against the permissions of the requesting identity. An authenticated identity holding the rest.identity permission, but not kura.admin, can assign any permission to any identity, including kura.admin to itself. It can also change the password of, or delete, identities holding more privileges than its own, including administrators, and create or delete permissions. This allows escalation to full administrative privileges and can lock legitimate administrators out of the device. The issue is fixed in Eclipse Kura 5.6.3."}],"id":"CVE-2026-112191","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T16:17:16.947","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-v8gf-9w4p-662w"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/431"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-112204.json b/data/2026/CVE-2026-112204.json index 4b145507f6..db5f7d9e61 100644 --- a/data/2026/CVE-2026-112204.json +++ b/data/2026/CVE-2026-112204.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["/index.php"],"product":"WidzialniCMS","vendor":"Fundacja Widzialni","versions":[{"lessThan":"2.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.\n\n\nThis issue has been fixed in version 2.5."}],"id":"CVE-2026-112204","lastModified":"2026-11-09T18:17:20.263","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112204","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:49:29.521039Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:04.820","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-110468"},{"source":"cvd@cert.pl","url":"https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cvd@cert.pl","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["/index.php"],"product":"WidzialniCMS","vendor":"Fundacja Widzialni","versions":[{"lessThan":"2.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.\n\n\nThis issue has been fixed in version 2.5."}],"id":"CVE-2026-112204","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112204","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:49:29.521039Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:04.820","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-110468"},{"source":"cvd@cert.pl","url":"https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cvd@cert.pl","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112205.json b/data/2026/CVE-2026-112205.json index 74de19844f..fcfc9af81b 100644 --- a/data/2026/CVE-2026-112205.json +++ b/data/2026/CVE-2026-112205.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WidzialniCMS","vendor":"Fundacja Widzialni","versions":[{"lessThan":"2.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.\n\n\n\n\nThis issue has been fixed in version 2.5."}],"id":"CVE-2026-112205","lastModified":"2026-11-09T18:17:20.393","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112205","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:50:04.410041Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:04.953","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-110468"},{"source":"cvd@cert.pl","url":"https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"cvd@cert.pl","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WidzialniCMS","vendor":"Fundacja Widzialni","versions":[{"lessThan":"2.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.\n\n\n\n\nThis issue has been fixed in version 2.5."}],"id":"CVE-2026-112205","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112205","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:50:04.410041Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:04.953","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/posts/2026/11/CVE-2026-110468"},{"source":"cvd@cert.pl","url":"https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"cvd@cert.pl","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112314.json b/data/2026/CVE-2026-112314.json index ffb9d5e1ab..2843687f54 100644 --- a/data/2026/CVE-2026-112314.json +++ b/data/2026/CVE-2026-112314.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}],"id":"CVE-2026-112314","lastModified":"2026-11-12T13:17:09.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112314","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:57:01.092807Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:39.867","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112314"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478446"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478446"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}],"id":"CVE-2026-112314","lastModified":"2026-11-12T18:17:13.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112314","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:57:01.092807Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:39.867","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112314"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478446"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478446"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112315.json b/data/2026/CVE-2026-112315.json index 8b260899da..a10711a5e8 100644 --- a/data/2026/CVE-2026-112315.json +++ b/data/2026/CVE-2026-112315.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}],"id":"CVE-2026-112315","lastModified":"2026-11-12T13:17:09.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:40.077","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112315"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479403"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}],"id":"CVE-2026-112315","lastModified":"2026-11-12T19:16:46.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112315","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:21.668280Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.077","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112315"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479403"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112316.json b/data/2026/CVE-2026-112316.json index c86853ed2d..a54004d62a 100644 --- a/data/2026/CVE-2026-112316.json +++ b/data/2026/CVE-2026-112316.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}],"id":"CVE-2026-112316","lastModified":"2026-11-12T13:17:10.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:01:26.177622Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.243","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112316"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479331"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}],"id":"CVE-2026-112316","lastModified":"2026-11-12T17:17:22.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:01:26.177622Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.243","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112316"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479331"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112317.json b/data/2026/CVE-2026-112317.json index b8e371ffae..52007116ed 100644 --- a/data/2026/CVE-2026-112317.json +++ b/data/2026/CVE-2026-112317.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}],"id":"CVE-2026-112317","lastModified":"2026-11-12T13:17:10.257","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:40.407","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112317"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479209"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}],"id":"CVE-2026-112317","lastModified":"2026-11-12T17:17:22.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:40.407","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112317"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479209"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112318.json b/data/2026/CVE-2026-112318.json index 0c971dd2f0..d32222459f 100644 --- a/data/2026/CVE-2026-112318.json +++ b/data/2026/CVE-2026-112318.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}],"id":"CVE-2026-112318","lastModified":"2026-11-12T13:17:10.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:40.560","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112318"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478792"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}],"id":"CVE-2026-112318","lastModified":"2026-11-12T17:17:22.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:40.560","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112318"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478792"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112319.json b/data/2026/CVE-2026-112319.json index c32e7dbc90..e898c62b88 100644 --- a/data/2026/CVE-2026-112319.json +++ b/data/2026/CVE-2026-112319.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}],"id":"CVE-2026-112319","lastModified":"2026-11-12T13:17:10.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112319","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:34:58.762680Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.727","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112319"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478684"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478684"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}],"id":"CVE-2026-112319","lastModified":"2026-11-12T17:17:22.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112319","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:34:58.762680Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.727","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112319"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478684"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478684"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112320.json b/data/2026/CVE-2026-112320.json index 7efb1e16d0..fa316da3b8 100644 --- a/data/2026/CVE-2026-112320.json +++ b/data/2026/CVE-2026-112320.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}],"id":"CVE-2026-112320","lastModified":"2026-11-12T13:17:10.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:40.887","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112320"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478449"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}],"id":"CVE-2026-112320","lastModified":"2026-11-12T19:16:46.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112320","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:24.602764Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.887","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112320"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478449"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112321.json b/data/2026/CVE-2026-112321.json index 520167ec16..9d86cdb64e 100644 --- a/data/2026/CVE-2026-112321.json +++ b/data/2026/CVE-2026-112321.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}],"id":"CVE-2026-112321","lastModified":"2026-11-12T13:17:10.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112321","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:02:10.203184Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:41.050","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112321"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478448"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}],"id":"CVE-2026-112321","lastModified":"2026-11-12T17:17:23.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112321","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:02:10.203184Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:41.050","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112321"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478448"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112322.json b/data/2026/CVE-2026-112322.json index 679fb2cf1d..a4087ed810 100644 --- a/data/2026/CVE-2026-112322.json +++ b/data/2026/CVE-2026-112322.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}],"id":"CVE-2026-112322","lastModified":"2026-11-12T13:17:11.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112322","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:59:29.778085Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:41.207","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112322"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478445"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}],"id":"CVE-2026-112322","lastModified":"2026-11-12T17:17:23.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112322","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:59:29.778085Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:41.207","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112322"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478445"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112323.json b/data/2026/CVE-2026-112323.json index a973d30209..15f436b3a3 100644 --- a/data/2026/CVE-2026-112323.json +++ b/data/2026/CVE-2026-112323.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}],"id":"CVE-2026-112323","lastModified":"2026-11-12T13:17:11.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:41.360","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112323"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478440"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}],"id":"CVE-2026-112323","lastModified":"2026-11-12T17:17:23.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:41.360","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112323"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478440"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112672.json b/data/2026/CVE-2026-112672.json index fccd8c8025..fde3f2a727 100644 --- a/data/2026/CVE-2026-112672.json +++ b/data/2026/CVE-2026-112672.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.2","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.2","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","matchCriteriaId":"855F5ECD-CA54-4DB4-8AD6-86383177270D","versionEndExcluding":"15.8.2","versionStartIncluding":"15.0","vulnerable":true},{"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","matchCriteriaId":"C07128F2-DA38-4B58-B8F5-5F1DA299EE2C","versionEndExcluding":"26.7.2","versionStartIncluding":"26.0","vulnerable":true},{"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","matchCriteriaId":"12846F95-3F15-4909-9FD2-591AA176A6F0","versionEndExcluding":"27.2","versionStartIncluding":"27.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A maliciously crafted ZIP archive may bypass Gatekeeper checks."}],"id":"CVE-2026-112672","lastModified":"2026-11-03T21:16:16.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-10-26T21:18:00.777","references":[{"source":"product-security@apple.com","tags":["Vendor Advisory"],"url":"https://support.apple.com/en-us/149521"},{"source":"product-security@apple.com","tags":["Vendor Advisory"],"url":"https://support.apple.com/en-us/149522"},{"source":"product-security@apple.com","tags":["Vendor Advisory"],"url":"https://support.apple.com/en-us/149523"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.2","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.2","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","matchCriteriaId":"855F5ECD-CA54-4DB4-8AD6-86383177270D","versionEndExcluding":"15.8.2","versionStartIncluding":"15.0","vulnerable":true},{"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","matchCriteriaId":"C07128F2-DA38-4B58-B8F5-5F1DA299EE2C","versionEndExcluding":"26.7.2","versionStartIncluding":"26.0","vulnerable":true},{"criteria":"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","matchCriteriaId":"12846F95-3F15-4909-9FD2-591AA176A6F0","versionEndExcluding":"27.2","versionStartIncluding":"27.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A maliciously crafted ZIP archive may bypass Gatekeeper checks."}],"id":"CVE-2026-112672","lastModified":"2026-11-12T19:16:46.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112672","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T18:08:43.945698Z","version":"2.0.3"}}]},"published":"2026-10-26T21:18:00.777","references":[{"source":"product-security@apple.com","tags":["Vendor Advisory"],"url":"https://support.apple.com/en-us/149521"},{"source":"product-security@apple.com","tags":["Vendor Advisory"],"url":"https://support.apple.com/en-us/149522"},{"source":"product-security@apple.com","tags":["Vendor Advisory"],"url":"https://support.apple.com/en-us/149523"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-290"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112803.json b/data/2026/CVE-2026-112803.json index 8be098a308..0860a27528 100644 --- a/data/2026/CVE-2026-112803.json +++ b/data/2026/CVE-2026-112803.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-112803","lastModified":"2026-11-11T18:18:38.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:22:15.539860Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:42.843","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112803"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-112803","lastModified":"2026-11-12T19:16:46.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:22:15.539860Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:42.843","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112803"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112809.json b/data/2026/CVE-2026-112809.json index 1112eb72d0..4dcc7de2a7 100644 --- a/data/2026/CVE-2026-112809.json +++ b/data/2026/CVE-2026-112809.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-112809","lastModified":"2026-11-11T18:18:38.777","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112809","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:21:05.582137Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:45.440","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112809"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-112809","lastModified":"2026-11-12T19:16:46.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112809","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:21:05.582137Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:45.440","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112809"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113408.json b/data/2026/CVE-2026-113408.json index 39c7e22939..527c69a896 100644 --- a/data/2026/CVE-2026-113408.json +++ b/data/2026/CVE-2026-113408.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"status":"affected","version":"2.50.1"},{"status":"affected","version":"2.51.2"},{"status":"affected","version":"2.52.0"},{"status":"affected","version":"2.53.0"},{"status":"affected","version":"2.54.0"},{"status":"affected","version":"2.55.0"},{"status":"affected","version":"2.56.0"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}],"id":"CVE-2026-113408","lastModified":"2026-11-12T07:16:45.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-12T07:16:45.597","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/809"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"status":"affected","version":"2.50.1"},{"status":"affected","version":"2.51.2"},{"status":"affected","version":"2.52.0"},{"status":"affected","version":"2.53.0"},{"status":"affected","version":"2.54.0"},{"status":"affected","version":"2.55.0"},{"status":"affected","version":"2.56.0"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}],"id":"CVE-2026-113408","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-12T07:16:45.597","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/809"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-113422.json b/data/2026/CVE-2026-113422.json index 3800537897..30e9cf80c1 100644 --- a/data/2026/CVE-2026-113422.json +++ b/data/2026/CVE-2026-113422.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"5.0.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0, org.eclipse.kura.rest.wire.provider), determine whether a configuration update targets a Wire Component, Driver or Asset from the factory identifier supplied in the request, instead of the actual factory of the existing component. An authenticated identity holding only the Wires management permission (kura.wires.admin for the Web UI, rest.wires.admin for the REST API) can therefore modify the configuration of existing components that are not part of the Wire Graph, including security-relevant ones, or replace existing components. This allows escalation to full administrative privileges and can disrupt the device. Modifying arbitrary components requires at least one Driver to be installed on the device. The issue is fixed in Eclipse Kura 5.6.3."}],"id":"CVE-2026-113422","lastModified":"2026-11-10T15:17:12.510","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T15:17:12.510","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-7pmq-r5px-vgw5"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/432"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"},{"lang":"en","value":"CWE-863"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"5.0.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 (available since 5.1.0, org.eclipse.kura.rest.wire.provider), determine whether a configuration update targets a Wire Component, Driver or Asset from the factory identifier supplied in the request, instead of the actual factory of the existing component. An authenticated identity holding only the Wires management permission (kura.wires.admin for the Web UI, rest.wires.admin for the REST API) can therefore modify the configuration of existing components that are not part of the Wire Graph, including security-relevant ones, or replace existing components. This allows escalation to full administrative privileges and can disrupt the device. Modifying arbitrary components requires at least one Driver to be installed on the device. The issue is fixed in Eclipse Kura 5.6.3."}],"id":"CVE-2026-113422","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T15:17:12.510","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-7pmq-r5px-vgw5"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/432"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"},{"lang":"en","value":"CWE-863"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-113431.json b/data/2026/CVE-2026-113431.json index 3af8a1e18c..4272d49cb0 100644 --- a/data/2026/CVE-2026-113431.json +++ b/data/2026/CVE-2026-113431.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["cow_http2_machine","cow_hpack"],"packageName":"cowlib","packageURL":"pkg:hex/cowlib","product":"cowlib","programFiles":["src/cow_http2_machine.erl","src/cow_hpack.erl"],"programRoutines":[{"name":"cow_http2_machine:headers_decode/4"},{"name":"cow_http2_machine:frame/2"},{"name":"cow_hpack:decode/3"},{"name":"cow_hpack:decode/2"}],"repo":"https://github.com/ninenines/cowlib","vendor":"ninenines","versions":[{"lessThan":"2.22.0","status":"affected","version":"2.7.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["cow_http2_machine","cow_hpack"],"packageName":"ninenines/cowlib","packageURL":"pkg:github/ninenines/cowlib","product":"cowlib","programFiles":["src/cow_http2_machine.erl","src/cow_hpack.erl"],"programRoutines":[{"name":"cow_http2_machine:headers_decode/4"},{"name":"cow_http2_machine:frame/2"},{"name":"cow_hpack:decode/3"},{"name":"cow_hpack:decode/2"}],"repo":"https://github.com/ninenines/cowlib","vendor":"ninenines","versions":[{"lessThan":"a3b15e29b3067644bfd580246c87f7af7a90b3b8","status":"affected","version":"b461b119e78e4e09bb28b186b09da7ed4a86a0dd","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields.\n\ncow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded.\n\nThis issue affects cowlib: from 2.7.0 before 2.22.0."}],"id":"CVE-2026-113431","lastModified":"2026-11-10T15:17:12.650","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113431","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:02:48.422648Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:04.410","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-113431.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ninenines/cowlib/commit/a3b15e29b3067644bfd580246c87f7af7a90b3b8"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ninenines/cowlib/commit/b461b119e78e4e09bb28b186b09da7ed4a86a0dd"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-113431"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["cow_http2_machine","cow_hpack"],"packageName":"cowlib","packageURL":"pkg:hex/cowlib","product":"cowlib","programFiles":["src/cow_http2_machine.erl","src/cow_hpack.erl"],"programRoutines":[{"name":"cow_http2_machine:headers_decode/4"},{"name":"cow_http2_machine:frame/2"},{"name":"cow_hpack:decode/3"},{"name":"cow_hpack:decode/2"}],"repo":"https://github.com/ninenines/cowlib","vendor":"ninenines","versions":[{"lessThan":"2.22.0","status":"affected","version":"2.7.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:ninenines:cowlib:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["cow_http2_machine","cow_hpack"],"packageName":"ninenines/cowlib","packageURL":"pkg:github/ninenines/cowlib","product":"cowlib","programFiles":["src/cow_http2_machine.erl","src/cow_hpack.erl"],"programRoutines":[{"name":"cow_http2_machine:headers_decode/4"},{"name":"cow_http2_machine:frame/2"},{"name":"cow_hpack:decode/3"},{"name":"cow_hpack:decode/2"}],"repo":"https://github.com/ninenines/cowlib","vendor":"ninenines","versions":[{"lessThan":"a3b15e29b3067644bfd580246c87f7af7a90b3b8","status":"affected","version":"b461b119e78e4e09bb28b186b09da7ed4a86a0dd","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields.\n\ncow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded.\n\nThis issue affects cowlib: from 2.7.0 before 2.22.0."}],"id":"CVE-2026-113431","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113431","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:02:48.422648Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:04.410","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-113431.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ninenines/cowlib/commit/a3b15e29b3067644bfd580246c87f7af7a90b3b8"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ninenines/cowlib/commit/b461b119e78e4e09bb28b186b09da7ed4a86a0dd"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-113431"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113437.json b/data/2026/CVE-2026-113437.json index 9db9aae351..278a6414a9 100644 --- a/data/2026/CVE-2026-113437.json +++ b/data/2026/CVE-2026-113437.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SS1","vendor":"DOS Co., Ltd.","versions":[{"lessThanOrEqual":"Agent version 17.0.0.50 (Media Versions 17.0.0e)","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"SS1 Cloud","vendor":"DOS Co., Ltd.","versions":[{"lessThanOrEqual":"Agent version 3.2.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"rocoeyes","vendor":"Rococo Co. Ltd.","versions":[{"lessThanOrEqual":"Agent versions 3.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. Arbitrary files may be deleted."}],"id":"CVE-2026-113437","lastModified":"2026-11-12T15:17:37.600","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.0"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113437","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:45:11.683910Z","version":"2.0.3"}}]},"published":"2026-11-09T08:17:02.063","references":[{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/jp/JVN76179675/"},{"source":"vultures@jpcert.or.jp","url":"https://www.dos-osaka.co.jp/news/2026/11/261109.html"},{"source":"vultures@jpcert.or.jp","url":"https://www.rococo.co.jp/wp-content/uploads/2026/11/20261109_rocoeyes.pdf"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"vultures@jpcert.or.jp","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SS1","vendor":"DOS Co., Ltd.","versions":[{"lessThanOrEqual":"Agent version 17.0.0.50 (Media Versions 17.0.0e)","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"SS1 Cloud","vendor":"DOS Co., Ltd.","versions":[{"lessThanOrEqual":"Agent version 3.2.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"rocoeyes","vendor":"Rococo Co. Ltd.","versions":[{"lessThanOrEqual":"Agent versions 3.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. Arbitrary files may be deleted."}],"id":"CVE-2026-113437","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.0"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113437","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:45:11.683910Z","version":"2.0.3"}}]},"published":"2026-11-09T08:17:02.063","references":[{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/jp/JVN76179675/"},{"source":"vultures@jpcert.or.jp","url":"https://www.dos-osaka.co.jp/news/2026/11/261109.html"},{"source":"vultures@jpcert.or.jp","url":"https://www.rococo.co.jp/wp-content/uploads/2026/11/20261109_rocoeyes.pdf"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"vultures@jpcert.or.jp","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113504.json b/data/2026/CVE-2026-113504.json index 007724bada..4cedbc7840 100644 --- a/data/2026/CVE-2026-113504.json +++ b/data/2026/CVE-2026-113504.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow","packageURL":"pkg:pypi/apache-airflow","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"2.1.1","versionType":"semver"}]},{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later."}],"id":"CVE-2026-113504","lastModified":"2026-11-10T21:12:58.107","metrics":{},"published":"2026-11-09T10:17:05.303","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73793"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/c0bzrpq913qh7srwdmx0smvt1tgvthrr"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/19"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow","packageURL":"pkg:pypi/apache-airflow","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"2.1.1","versionType":"semver"}]},{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later."}],"id":"CVE-2026-113504","lastModified":"2026-11-12T17:17:23.567","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:01:44.858289Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:05.303","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73793"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/c0bzrpq913qh7srwdmx0smvt1tgvthrr"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/19"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113508.json b/data/2026/CVE-2026-113508.json index b88926d845..2f81b90bb1 100644 --- a/data/2026/CVE-2026-113508.json +++ b/data/2026/CVE-2026-113508.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later."}],"id":"CVE-2026-113508","lastModified":"2026-11-10T21:12:56.680","metrics":{},"published":"2026-11-09T10:17:05.463","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73562"},{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73788"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/6t892ozodb9f3498jrsc8k0crbdnm7no"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/20"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the FAB or Keycloak auth managers), server-side revocation is the only thing that invalidates the Airflow token; it failed on database errors and, reliably, for tokens from an external issuer accepted via `[api_auth] trusted_jwks_url` whose token identifier is longer than 32 characters. Anyone holding a copy of a user's token from before logout could keep using it against the Airflow API until it expired. Users are advised to upgrade to apache-airflow 3.4.0 or later."}],"id":"CVE-2026-113508","lastModified":"2026-11-12T17:17:23.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113508","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:14:04.407450Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:05.463","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73562"},{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73788"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/6t892ozodb9f3498jrsc8k0crbdnm7no"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/20"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113573.json b/data/2026/CVE-2026-113573.json index dc99505241..838fc543e7 100644 --- a/data/2026/CVE-2026-113573.json +++ b/data/2026/CVE-2026-113573.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-113573","lastModified":"2026-11-10T22:18:21.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:21.870","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-113573","lastModified":"2026-11-12T18:17:13.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:41.054619Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:21.870","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113574.json b/data/2026/CVE-2026-113574.json index c197fe81cb..43506fb682 100644 --- a/data/2026/CVE-2026-113574.json +++ b/data/2026/CVE-2026-113574.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-113574","lastModified":"2026-11-10T22:18:22.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:22.010","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-113574","lastModified":"2026-11-12T19:16:47.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:10:59.933657Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:22.010","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113579.json b/data/2026/CVE-2026-113579.json index eb53656ac4..c21ab136e7 100644 --- a/data/2026/CVE-2026-113579.json +++ b/data/2026/CVE-2026-113579.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-113579","lastModified":"2026-11-11T11:17:12.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:49.425093Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:22.360","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-113579","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:49.425093Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:22.360","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113580.json b/data/2026/CVE-2026-113580.json index 867406b7e3..411839ad5b 100644 --- a/data/2026/CVE-2026-113580.json +++ b/data/2026/CVE-2026-113580.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-113580","lastModified":"2026-11-11T11:17:12.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:48.282140Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:22.493","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-113580","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:48.282140Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:22.493","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113618.json b/data/2026/CVE-2026-113618.json index 030737d944..1b32d5fee8 100644 --- a/data/2026/CVE-2026-113618.json +++ b/data/2026/CVE-2026-113618.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ZSIRep Client Library","programFiles":["ZSIREP.CLIENT.DLL"],"vendor":"KAMSOFT","versions":[{"lessThan":"2.12.3.1","status":"affected","version":"0.0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It registers a process-wide .NET callback that accepts any certificate for HTTPS connections without verification. This allows a man-in-the-middle attacker to impersonate the ZSIRep server and intercept or modify authentication data and documents. The callback persists after the client is closed, weakening other HTTPS connections in the same application.\n\n\nThe issue was fixed in version 2.12.3.1. The library is used in KS-SOMED (fixed in 2026.03.0.01), KS-PPS (fixed in 2026.03.1.0), KS-MEDIS (fixed in 2026.03.0.0), KS-SOLAB (fixed in 2026.3.1.0), and KS-ASW (fixed in 2026.3.0.1)."}],"id":"CVE-2026-113618","lastModified":"2026-11-06T18:17:50.037","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:24:46.322233Z","version":"2.0.3"}}]},"published":"2026-11-06T15:17:08.873","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/en/posts/2026/11/CVE-2026-113618"},{"source":"cvd@cert.pl","url":"https://edm.kamsoft.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"cvd@cert.pl","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ZSIRep Client Library","programFiles":["ZSIREP.CLIENT.DLL"],"vendor":"KAMSOFT","versions":[{"lessThan":"2.12.3.1","status":"affected","version":"0.0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It registers a process-wide .NET callback that accepts any certificate for HTTPS connections without verification. This allows a man-in-the-middle attacker to impersonate the ZSIRep server and intercept or modify authentication data and documents. The callback persists after the client is closed, weakening other HTTPS connections in the same application.\n\n\nThe issue was fixed in version 2.12.3.1. The library is used in KS-SOMED (fixed in 2026.03.0.01), KS-PPS (fixed in 2026.03.1.0), KS-MEDIS (fixed in 2026.03.0.0), KS-SOLAB (fixed in 2026.3.1.0), and KS-ASW (fixed in 2026.3.0.1)."}],"id":"CVE-2026-113618","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:24:46.322233Z","version":"2.0.3"}}]},"published":"2026-11-06T15:17:08.873","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/en/posts/2026/11/CVE-2026-113618"},{"source":"cvd@cert.pl","url":"https://edm.kamsoft.pl/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"cvd@cert.pl","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-11376.json b/data/2026/CVE-2026-11376.json index 9ddadfbc0d..50d1bf0434 100644 --- a/data/2026/CVE-2026-11376.json +++ b/data/2026/CVE-2026-11376.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*"],"product":"MQ","vendor":"IBM","versions":[{"lessThanOrEqual":"9.2.0.44","status":"affected","version":"9.2.0.0","versionType":"semver"},{"lessThanOrEqual":"9.3.0.42","status":"affected","version":"9.3.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.0.26","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.5.1","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.0.5","status":"affected","version":"10.0.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values."}],"id":"CVE-2026-11376","lastModified":"2026-11-06T12:17:19.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-11376","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:24.901512Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:56.403","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294498"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*"],"product":"MQ","vendor":"IBM","versions":[{"lessThanOrEqual":"9.2.0.44","status":"affected","version":"9.2.0.0","versionType":"semver"},{"lessThanOrEqual":"9.3.0.42","status":"affected","version":"9.3.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.0.26","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.5.1","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.0.5","status":"affected","version":"10.0.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"44950C6B-710F-4B6B-BFAE-73E4407F51B9","versionEndExcluding":"9.2.0.46","versionStartIncluding":"9.2.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"C068FAC7-7DCA-4E46-9B3F-06F513967C6A","versionEndExcluding":"9.3.0.43","versionStartIncluding":"9.3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"9E0A65D6-9040-41E2-8B5F-3264D565E761","versionEndExcluding":"9.4.0.30","versionStartIncluding":"9.4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:continuous_delivery:*:*:*","matchCriteriaId":"53BCC172-C8CC-4B55-A7C5-F262E5CC7274","versionEndIncluding":"9.4.5.1","versionStartIncluding":"9.4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:continuous_delivery:*:*:*","matchCriteriaId":"391B1041-23BF-4298-B1D3-4434C2B923CE","versionEndExcluding":"10.0.0.6","versionStartIncluding":"10.0.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"88A41538-EECC-4308-B3D8-F9742A3C2A05","versionEndExcluding":"10.0.0.6","versionStartIncluding":"10.0.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values."}],"id":"CVE-2026-11376","lastModified":"2026-11-12T17:30:11.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-11376","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:24.901512Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:56.403","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7294498"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113782.json b/data/2026/CVE-2026-113782.json index ee63e0ab59..df16530ef9 100644 --- a/data/2026/CVE-2026-113782.json +++ b/data/2026/CVE-2026-113782.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"esp-idf","vendor":"espressif","versions":[{"status":"affected","version":">= 5.2.0, < 5.2.8"},{"status":"affected","version":">= 5.3.0, < 5.3.6"},{"status":"affected","version":">= 5.4.0, < 5.4.5"},{"status":"affected","version":">= 5.5.0, < 5.5.5"},{"status":"affected","version":">= 6.0.0, < 6.0.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5."}],"id":"CVE-2026-113782","lastModified":"2026-11-09T17:17:10.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113782","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:46:19.199848Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:18.717","references":[{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/4068c4e7d061b3e2d6096734509feadc14594e28"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/b6860b2db50406adf0aaebd75f2e9fe64cc805a9"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/c22480ba07fc1de454a63d42275c764d95c7bd9c"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/c828d0d709f1c46fa2b9e1ed3ce9d8dc4b29c42f"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/e18d27e480aec2b282898f4afc22b0f738ea7c04"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/f9bb1be59081ccef03a1b4b1fab9a225f28b1b61"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-c26h-gm53-qg83"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"esp-idf","vendor":"espressif","versions":[{"status":"affected","version":">= 5.2.0, < 5.2.8"},{"status":"affected","version":">= 5.3.0, < 5.3.6"},{"status":"affected","version":">= 5.4.0, < 5.4.5"},{"status":"affected","version":">= 5.5.0, < 5.5.5"},{"status":"affected","version":">= 6.0.0, < 6.0.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5."}],"id":"CVE-2026-113782","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113782","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:46:19.199848Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:18.717","references":[{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/4068c4e7d061b3e2d6096734509feadc14594e28"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/b6860b2db50406adf0aaebd75f2e9fe64cc805a9"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/c22480ba07fc1de454a63d42275c764d95c7bd9c"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/c828d0d709f1c46fa2b9e1ed3ce9d8dc4b29c42f"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/e18d27e480aec2b282898f4afc22b0f738ea7c04"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/f9bb1be59081ccef03a1b4b1fab9a225f28b1b61"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-c26h-gm53-qg83"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113783.json b/data/2026/CVE-2026-113783.json index 2ebab97bec..a4ba5ce802 100644 --- a/data/2026/CVE-2026-113783.json +++ b/data/2026/CVE-2026-113783.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"esp-idf","vendor":"espressif","versions":[{"status":"affected","version":">= 5.2.3, <= 5.2.8"},{"status":"affected","version":">= 5.3.2, < 5.3.7"},{"status":"affected","version":">= 5.4.0, < 5.4.5"},{"status":"affected","version":">= 5.5.0, < 5.5.6"},{"status":"affected","version":">= 6.0.0, < 6.0.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line."}],"id":"CVE-2026-113783","lastModified":"2026-11-09T17:17:10.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113783","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:51:06.656964Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:18.907","references":[{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/75f2ff7e0c2d19e113293ec122b701c83d2f6665"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/7ab85eb4dc7d7695960d940badcd62592c365056"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/882843dbf838b0c02e09d46bb6283bda73496b8c"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/98e6e7a08fca391563651a1e751cc45a3b27d18b"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/af7543d00a4d7b489e010a70b59fd3d8022a40f4"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/defaa2f559470acfee5e2e5ea80a79b73424d483"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-ch63-jxm5-vmvf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"esp-idf","vendor":"espressif","versions":[{"status":"affected","version":">= 5.2.3, <= 5.2.8"},{"status":"affected","version":">= 5.3.2, < 5.3.7"},{"status":"affected","version":">= 5.4.0, < 5.4.5"},{"status":"affected","version":">= 5.5.0, < 5.5.6"},{"status":"affected","version":">= 6.0.0, < 6.0.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line."}],"id":"CVE-2026-113783","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113783","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:51:06.656964Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:18.907","references":[{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/75f2ff7e0c2d19e113293ec122b701c83d2f6665"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/7ab85eb4dc7d7695960d940badcd62592c365056"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/882843dbf838b0c02e09d46bb6283bda73496b8c"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/98e6e7a08fca391563651a1e751cc45a3b27d18b"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/af7543d00a4d7b489e010a70b59fd3d8022a40f4"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/defaa2f559470acfee5e2e5ea80a79b73424d483"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-ch63-jxm5-vmvf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113843.json b/data/2026/CVE-2026-113843.json index e9eea55ac9..054c30363f 100644 --- a/data/2026/CVE-2026-113843.json +++ b/data/2026/CVE-2026-113843.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-113843","lastModified":"2026-11-11T18:18:46.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113843","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:07:31.541027Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:05.373","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113843"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-113843","lastModified":"2026-11-12T20:18:16.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113843","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:07:31.541027Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:05.373","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113843"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113960.json b/data/2026/CVE-2026-113960.json index e3dd6eeada..219d67403e 100644 --- a/data/2026/CVE-2026-113960.json +++ b/data/2026/CVE-2026-113960.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined."}],"id":"CVE-2026-113960","lastModified":"2026-11-10T21:51:05.030","metrics":{},"published":"2026-11-09T22:18:25.760","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined."}],"id":"CVE-2026-113960","lastModified":"2026-11-12T18:17:13.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113960","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:36:45.582113Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:25.760","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113969.json b/data/2026/CVE-2026-113969.json index 54c8c3d4b9..8249f65669 100644 --- a/data/2026/CVE-2026-113969.json +++ b/data/2026/CVE-2026-113969.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts."}],"id":"CVE-2026-113969","lastModified":"2026-11-10T21:51:05.030","metrics":{},"published":"2026-11-09T22:18:26.800","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts."}],"id":"CVE-2026-113969","lastModified":"2026-11-12T18:17:13.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113969","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:50.718860Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.800","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114031.json b/data/2026/CVE-2026-114031.json index 1242b81bce..7dd1f6246d 100644 --- a/data/2026/CVE-2026-114031.json +++ b/data/2026/CVE-2026-114031.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Core Ven","vendor":"Illumio","versions":[{"lessThan":"26.2.12-S1","status":"affected","version":"26.2.12","versionType":"semver"},{"lessThan":"25.2.41-S1","status":"affected","version":"25.2.41","versionType":"semver"},{"lessThan":"25.2.40-S1","status":"affected","version":"25.2.40","versionType":"semver"},{"lessThan":"25.2.31-S1","status":"affected","version":"25.2.31","versionType":"semver"},{"lessThan":"25.2.20-S1","status":"affected","version":"25.2.20","versionType":"semver"},{"lessThan":"25.2.10-S1","status":"affected","version":"25.2.10","versionType":"semver"},{"lessThan":"24.2.40-S1","status":"affected","version":"24.2.40","versionType":"semver"},{"lessThan":"24.2.35-S1","status":"affected","version":"24.2.35","versionType":"semver"},{"lessThan":"24.2.30-S1","status":"affected","version":"24.2.30","versionType":"semver"},{"lessThan":"24.2.20-S1","status":"affected","version":"24.2.20","versionType":"semver"},{"lessThan":"24.2.11-S1","status":"affected","version":"24.2.11","versionType":"semver"},{"lessThan":"24.2.10-S1","status":"affected","version":"24.2.10","versionType":"semver"},{"lessThan":"23.2.31-S1","status":"affected","version":"23.2.31","versionType":"semver"},{"lessThan":"23.2.31-LA-S1","status":"affected","version":"23.2.31-LA","versionType":"semver"},{"lessThan":"23.2.30-S1","status":"affected","version":"23.2.30","versionType":"semver"},{"lessThan":"23.2.24-S1","status":"affected","version":"23.2.24","versionType":"semver"},{"lessThan":"23.2.24-LA-S1","status":"affected","version":"23.2.24-LA","versionType":"semver"},{"lessThan":"23.2.23-S1","status":"affected","version":"23.2.23","versionType":"semver"},{"lessThan":"23.2.22-S1","status":"affected","version":"23.2.22","versionType":"semver"},{"lessThan":"23.2.22-LA-S1","status":"affected","version":"23.2.22-LA","versionType":"semver"}]}],"source":"security@illumio.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL SERVICE full access to the VEN data and installation folders, whose configuration and state files are read and trusted by the SYSTEM-privileged illumio-ven-ctl component. An attacker can leverage this vulnerability to modify the VEN configuration so that illumio-ven-ctl executes an injected command in the context of the SYSTEM account."}],"id":"CVE-2026-114031","lastModified":"2026-11-10T20:18:00.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@illumio.com","type":"Secondary"}]},"published":"2026-11-09T22:18:27.257","references":[{"source":"security@illumio.com","url":"https://product-docs-repo.illumio.com/Tech-Docs/Security+Advisories/out/en/security-advisories/insecure-folder-permissions-in-the-windows-ven.html"}],"sourceIdentifier":"security@illumio.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"security@illumio.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Core Ven","vendor":"Illumio","versions":[{"lessThan":"26.2.12-S1","status":"affected","version":"26.2.12","versionType":"semver"},{"lessThan":"25.2.41-S1","status":"affected","version":"25.2.41","versionType":"semver"},{"lessThan":"25.2.40-S1","status":"affected","version":"25.2.40","versionType":"semver"},{"lessThan":"25.2.31-S1","status":"affected","version":"25.2.31","versionType":"semver"},{"lessThan":"25.2.20-S1","status":"affected","version":"25.2.20","versionType":"semver"},{"lessThan":"25.2.10-S1","status":"affected","version":"25.2.10","versionType":"semver"},{"lessThan":"24.2.40-S1","status":"affected","version":"24.2.40","versionType":"semver"},{"lessThan":"24.2.35-S1","status":"affected","version":"24.2.35","versionType":"semver"},{"lessThan":"24.2.30-S1","status":"affected","version":"24.2.30","versionType":"semver"},{"lessThan":"24.2.20-S1","status":"affected","version":"24.2.20","versionType":"semver"},{"lessThan":"24.2.11-S1","status":"affected","version":"24.2.11","versionType":"semver"},{"lessThan":"24.2.10-S1","status":"affected","version":"24.2.10","versionType":"semver"},{"lessThan":"23.2.31-S1","status":"affected","version":"23.2.31","versionType":"semver"},{"lessThan":"23.2.31-LA-S1","status":"affected","version":"23.2.31-LA","versionType":"semver"},{"lessThan":"23.2.30-S1","status":"affected","version":"23.2.30","versionType":"semver"},{"lessThan":"23.2.24-S1","status":"affected","version":"23.2.24","versionType":"semver"},{"lessThan":"23.2.24-LA-S1","status":"affected","version":"23.2.24-LA","versionType":"semver"},{"lessThan":"23.2.23-S1","status":"affected","version":"23.2.23","versionType":"semver"},{"lessThan":"23.2.22-S1","status":"affected","version":"23.2.22","versionType":"semver"},{"lessThan":"23.2.22-LA-S1","status":"affected","version":"23.2.22-LA","versionType":"semver"}]}],"source":"security@illumio.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL SERVICE full access to the VEN data and installation folders, whose configuration and state files are read and trusted by the SYSTEM-privileged illumio-ven-ctl component. An attacker can leverage this vulnerability to modify the VEN configuration so that illumio-ven-ctl executes an injected command in the context of the SYSTEM account."}],"id":"CVE-2026-114031","lastModified":"2026-11-12T17:17:23.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@illumio.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114031","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:10:35.342224Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:27.257","references":[{"source":"security@illumio.com","url":"https://product-docs-repo.illumio.com/Tech-Docs/Security+Advisories/out/en/security-advisories/insecure-folder-permissions-in-the-windows-ven.html"}],"sourceIdentifier":"security@illumio.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"security@illumio.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114032.json b/data/2026/CVE-2026-114032.json index 97f9312189..7d12fec8f6 100644 --- a/data/2026/CVE-2026-114032.json +++ b/data/2026/CVE-2026-114032.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Core Ven","vendor":"Illumio","versions":[{"lessThan":"26.2.20","status":"affected","version":"24.2.20","versionType":"semver"}]}],"source":"security@illumio.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially leverage this vulnerability to execute arbitrary code with SYSTEM privileges."}],"id":"CVE-2026-114032","lastModified":"2026-11-09T22:18:27.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@illumio.com","type":"Secondary"}]},"published":"2026-11-09T22:18:27.397","references":[{"source":"security@illumio.com","url":"https://product-docs-repo.illumio.com/Tech-Docs/Security+Advisories/out/en/security-advisories/untrusted-openssl-configuration-load-in-the-windows-ven.html"}],"sourceIdentifier":"security@illumio.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"security@illumio.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Core Ven","vendor":"Illumio","versions":[{"lessThan":"26.2.20","status":"affected","version":"24.2.20","versionType":"semver"}]}],"source":"security@illumio.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially leverage this vulnerability to execute arbitrary code with SYSTEM privileges."}],"id":"CVE-2026-114032","lastModified":"2026-11-12T18:17:13.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@illumio.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114032","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:14:02.415605Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:27.397","references":[{"source":"security@illumio.com","url":"https://product-docs-repo.illumio.com/Tech-Docs/Security+Advisories/out/en/security-advisories/untrusted-openssl-configuration-load-in-the-windows-ven.html"}],"sourceIdentifier":"security@illumio.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"security@illumio.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114359.json b/data/2026/CVE-2026-114359.json index 7fd1363884..ee8425fd20 100644 --- a/data/2026/CVE-2026-114359.json +++ b/data/2026/CVE-2026-114359.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"0.7.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service of the device: failed configuration persistence, failed logging and possible crashes of the framework or other services.\n\n\n\nThe same missing size limit is present in the REST upload endpoint `POST /deploy/v2/_upload`, which copies the request body to the temporary directory with no limit.\n\n\n\nWorkarounds: only install DPs from trusted HTTPS sources, restrict who can install packages (Web UI `kura.packages.admin` permission, REST `kura.permission.rest.deploy`, cloud DEPLOY-V2 access)."}],"id":"CVE-2026-114359","lastModified":"2026-11-10T15:17:12.933","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T15:17:12.933","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-r8mm-3wcm-qmx4"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/481"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"0.7.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large (or endless) response. Kura writes the response to local storage until the filesystem is full. On gateways the temporary directory is often a RAM-backed tmpfs, so this can also exhaust memory. The result is denial of service of the device: failed configuration persistence, failed logging and possible crashes of the framework or other services.\n\n\n\nThe same missing size limit is present in the REST upload endpoint `POST /deploy/v2/_upload`, which copies the request body to the temporary directory with no limit.\n\n\n\nWorkarounds: only install DPs from trusted HTTPS sources, restrict who can install packages (Web UI `kura.packages.admin` permission, REST `kura.permission.rest.deploy`, cloud DEPLOY-V2 access)."}],"id":"CVE-2026-114359","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T15:17:12.933","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-r8mm-3wcm-qmx4"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/481"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114371.json b/data/2026/CVE-2026-114371.json index 544103b00f..6e9a893313 100644 --- a/data/2026/CVE-2026-114371.json +++ b/data/2026/CVE-2026-114371.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-114371","lastModified":"2026-11-11T11:17:12.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:47.068793Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:22.617","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-114371","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:47.068793Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:22.617","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114372.json b/data/2026/CVE-2026-114372.json index 8d00732a0b..dcb0dedd30 100644 --- a/data/2026/CVE-2026-114372.json +++ b/data/2026/CVE-2026-114372.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}],"id":"CVE-2026-114372","lastModified":"2026-11-10T22:18:22.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:22.753","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}],"id":"CVE-2026-114372","lastModified":"2026-11-12T18:17:14.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114372","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:46.560335Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:22.753","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114466.json b/data/2026/CVE-2026-114466.json index 5c3c09644c..0fda345165 100644 --- a/data/2026/CVE-2026-114466.json +++ b/data/2026/CVE-2026-114466.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"status":"affected","version":"2.50.1"},{"status":"affected","version":"2.51.2"},{"status":"affected","version":"2.52.0"},{"status":"affected","version":"2.53.0"},{"status":"affected","version":"2.54.0"},{"status":"affected","version":"2.55.0"},{"status":"affected","version":"2.56.0"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}],"id":"CVE-2026-114466","lastModified":"2026-11-12T14:17:23.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-12T14:17:23.203","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/812"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"status":"affected","version":"2.50.1"},{"status":"affected","version":"2.51.2"},{"status":"affected","version":"2.52.0"},{"status":"affected","version":"2.53.0"},{"status":"affected","version":"2.54.0"},{"status":"affected","version":"2.55.0"},{"status":"affected","version":"2.56.0"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}],"id":"CVE-2026-114466","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-12T14:17:23.203","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/812"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114467.json b/data/2026/CVE-2026-114467.json index 5e94a51e20..cc932fcd6c 100644 --- a/data/2026/CVE-2026-114467.json +++ b/data/2026/CVE-2026-114467.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"status":"affected","version":"2.50.1"},{"status":"affected","version":"2.51.2"},{"status":"affected","version":"2.52.0"},{"status":"affected","version":"2.53.0"},{"status":"affected","version":"2.54.0"},{"status":"affected","version":"2.55.0"},{"status":"affected","version":"2.56.0"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}],"id":"CVE-2026-114467","lastModified":"2026-11-12T14:17:23.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-12T14:17:23.360","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/810"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"status":"affected","version":"2.50.1"},{"status":"affected","version":"2.51.2"},{"status":"affected","version":"2.52.0"},{"status":"affected","version":"2.53.0"},{"status":"affected","version":"2.54.0"},{"status":"affected","version":"2.55.0"},{"status":"affected","version":"2.56.0"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}],"id":"CVE-2026-114467","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-12T14:17:23.360","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/810"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114469.json b/data/2026/CVE-2026-114469.json index e692e06549..b00788d60d 100644 --- a/data/2026/CVE-2026-114469.json +++ b/data/2026/CVE-2026-114469.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"status":"affected","version":"2.50.1"},{"status":"affected","version":"2.51.2"},{"status":"affected","version":"2.52.0"},{"status":"affected","version":"2.53.0"},{"status":"affected","version":"2.54.0"},{"status":"affected","version":"2.55.0"},{"status":"affected","version":"2.56.0"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}],"id":"CVE-2026-114469","lastModified":"2026-11-12T14:17:23.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-12T14:17:23.500","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/811"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"status":"affected","version":"2.50.1"},{"status":"affected","version":"2.51.2"},{"status":"affected","version":"2.52.0"},{"status":"affected","version":"2.53.0"},{"status":"affected","version":"2.54.0"},{"status":"affected","version":"2.55.0"},{"status":"affected","version":"2.56.0"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}],"id":"CVE-2026-114469","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-12T14:17:23.500","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/811"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114543.json b/data/2026/CVE-2026-114543.json index f28a01e8b1..ddc0373110 100644 --- a/data/2026/CVE-2026-114543.json +++ b/data/2026/CVE-2026-114543.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://www.drupal.org/project/simple_user_management","product":"Simple User Management","repo":"https://git.drupalcode.org/project/simple_user_management","vendor":"Drupal","versions":[{"lessThan":"1.11.0","status":"affected","version":"0.0.0","versionType":"semver"}]}],"source":"mlhess@drupal.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0."}],"id":"CVE-2026-114543","lastModified":"2026-10-30T19:27:58.620","metrics":{},"published":"2026-10-30T04:18:13.267","references":[{"source":"mlhess@drupal.org","url":"https://www.drupal.org/sa-contrib-2026-239"}],"sourceIdentifier":"mlhess@drupal.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"mlhess@drupal.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://www.drupal.org/project/simple_user_management","product":"Simple User Management","repo":"https://git.drupalcode.org/project/simple_user_management","vendor":"Drupal","versions":[{"lessThan":"1.11.0","status":"affected","version":"0.0.0","versionType":"semver"}]}],"source":"mlhess@drupal.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0."}],"id":"CVE-2026-114543","lastModified":"2026-11-12T19:16:47.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T14:42:52.686537Z","version":"2.0.3"}}]},"published":"2026-10-30T04:18:13.267","references":[{"source":"mlhess@drupal.org","url":"https://www.drupal.org/sa-contrib-2026-239"}],"sourceIdentifier":"mlhess@drupal.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"mlhess@drupal.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114549.json b/data/2026/CVE-2026-114549.json index b0a59c70f8..b1ea71c94e 100644 --- a/data/2026/CVE-2026-114549.json +++ b/data/2026/CVE-2026-114549.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"NoMachine","vendor":"NoMachine","versions":[{"status":"affected","version":"9.7.3"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685."}],"id":"CVE-2026-114549","lastModified":"2026-11-06T19:17:35.633","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114549","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T18:54:22.382693Z","version":"2.0.3"}}]},"published":"2026-11-04T00:17:22.627","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-786/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"NoMachine","vendor":"NoMachine","versions":[{"status":"affected","version":"9.7.3"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685."}],"id":"CVE-2026-114549","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114549","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T18:54:22.382693Z","version":"2.0.3"}}]},"published":"2026-11-04T00:17:22.627","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-786/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114550.json b/data/2026/CVE-2026-114550.json index 73423f853b..f0c03fbd82 100644 --- a/data/2026/CVE-2026-114550.json +++ b/data/2026/CVE-2026-114550.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"libwebsockets","vendor":"libwebsockets","versions":[{"status":"affected","version":"b4b5aed3903eaff09cd76a410f69bbe5dff66f8e"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039."}],"id":"CVE-2026-114550","lastModified":"2026-11-06T19:17:35.763","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114550","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T18:54:55.995464Z","version":"2.0.3"}}]},"published":"2026-11-04T00:17:22.783","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://github.com/warmcat/libwebsockets/commit/c9e8e1834d7f13038c82963086b90e2ee9c5b44c"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-792/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"libwebsockets","vendor":"libwebsockets","versions":[{"status":"affected","version":"b4b5aed3903eaff09cd76a410f69bbe5dff66f8e"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039."}],"id":"CVE-2026-114550","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114550","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T18:54:55.995464Z","version":"2.0.3"}}]},"published":"2026-11-04T00:17:22.783","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://github.com/warmcat/libwebsockets/commit/c9e8e1834d7f13038c82963086b90e2ee9c5b44c"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-792/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114551.json b/data/2026/CVE-2026-114551.json index 7489d208da..62957c647e 100644 --- a/data/2026/CVE-2026-114551.json +++ b/data/2026/CVE-2026-114551.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"MailEnable","vendor":"MailEnable","versions":[{"status":"affected","version":"10.59"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MailEnable Auth Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of mailbox credentials. The issue results from storing sensitive information in plaintext. An attacker can leverage this in conjunction with other vulnerabilities to disclose stored credentials, leading to further compromise. Was ZDI-CAN-34478."}],"id":"CVE-2026-114551","lastModified":"2026-11-06T19:17:35.890","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114551","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T18:56:00.847788Z","version":"2.0.3"}}]},"published":"2026-11-04T00:17:22.943","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-810/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"MailEnable","vendor":"MailEnable","versions":[{"status":"affected","version":"10.59"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MailEnable Auth Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of mailbox credentials. The issue results from storing sensitive information in plaintext. An attacker can leverage this in conjunction with other vulnerabilities to disclose stored credentials, leading to further compromise. Was ZDI-CAN-34478."}],"id":"CVE-2026-114551","lastModified":"2026-11-12T18:48:46.580","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114551","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T18:56:00.847788Z","version":"2.0.3"}}]},"published":"2026-11-04T00:17:22.943","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-810/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114552.json b/data/2026/CVE-2026-114552.json index 480619b498..d0764b19a4 100644 --- a/data/2026/CVE-2026-114552.json +++ b/data/2026/CVE-2026-114552.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"MailEnable","vendor":"MailEnable","versions":[{"status":"affected","version":"10.59"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the parseObjectResponse method. The issue results from the lack of proper restriction of XML External Entity (XXE) references. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-29137."}],"id":"CVE-2026-114552","lastModified":"2026-11-06T19:17:36.007","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T18:56:26.843216Z","version":"2.0.3"}}]},"published":"2026-11-04T00:17:23.133","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-811/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"MailEnable","vendor":"MailEnable","versions":[{"status":"affected","version":"10.59"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the parseObjectResponse method. The issue results from the lack of proper restriction of XML External Entity (XXE) references. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-29137."}],"id":"CVE-2026-114552","lastModified":"2026-11-12T18:48:46.580","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T18:56:26.843216Z","version":"2.0.3"}}]},"published":"2026-11-04T00:17:23.133","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-811/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114556.json b/data/2026/CVE-2026-114556.json index 074cd99290..f9d82a8ba0 100644 --- a/data/2026/CVE-2026-114556.json +++ b/data/2026/CVE-2026-114556.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"MailEnable","vendor":"MailEnable","versions":[{"status":"affected","version":"10.59"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of MailEnable. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Save method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-29161."}],"id":"CVE-2026-114556","lastModified":"2026-11-12T03:17:08.277","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.277","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-869/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"MailEnable","vendor":"MailEnable","versions":[{"status":"affected","version":"10.59"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of MailEnable. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Save method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-29161."}],"id":"CVE-2026-114556","lastModified":"2026-11-12T18:48:46.580","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.277","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-869/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114558.json b/data/2026/CVE-2026-114558.json index 428637e4fe..0467a4dcea 100644 --- a/data/2026/CVE-2026-114558.json +++ b/data/2026/CVE-2026-114558.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30738."}],"id":"CVE-2026-114558","lastModified":"2026-11-12T03:17:08.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.417","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114558"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-886/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30738."}],"id":"CVE-2026-114558","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.417","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114558"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-886/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114559.json b/data/2026/CVE-2026-114559.json index 4277e59be7..8415dac8b1 100644 --- a/data/2026/CVE-2026-114559.json +++ b/data/2026/CVE-2026-114559.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30431."}],"id":"CVE-2026-114559","lastModified":"2026-11-12T03:17:08.560","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.560","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114559"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-876/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30431."}],"id":"CVE-2026-114559","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.560","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114559"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-876/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114560.json b/data/2026/CVE-2026-114560.json index 9f1163eb40..66f999d869 100644 --- a/data/2026/CVE-2026-114560.json +++ b/data/2026/CVE-2026-114560.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30432."}],"id":"CVE-2026-114560","lastModified":"2026-11-12T03:17:08.700","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.700","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114560"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-877/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30432."}],"id":"CVE-2026-114560","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.700","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114560"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-877/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114561.json b/data/2026/CVE-2026-114561.json index c1a46b4e3d..3345904bf6 100644 --- a/data/2026/CVE-2026-114561.json +++ b/data/2026/CVE-2026-114561.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30433."}],"id":"CVE-2026-114561","lastModified":"2026-11-12T03:17:08.843","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.843","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114561"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-878/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30433."}],"id":"CVE-2026-114561","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.843","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114561"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-878/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114562.json b/data/2026/CVE-2026-114562.json index 9a0eaacef8..eee4d8c651 100644 --- a/data/2026/CVE-2026-114562.json +++ b/data/2026/CVE-2026-114562.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30736."}],"id":"CVE-2026-114562","lastModified":"2026-11-12T03:17:08.980","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.980","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114562"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-879/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30736."}],"id":"CVE-2026-114562","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.980","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114562"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-879/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114563.json b/data/2026/CVE-2026-114563.json index 830630ebd2..3f0374b720 100644 --- a/data/2026/CVE-2026-114563.json +++ b/data/2026/CVE-2026-114563.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30737."}],"id":"CVE-2026-114563","lastModified":"2026-11-12T03:17:09.110","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.110","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114563"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-880/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30737."}],"id":"CVE-2026-114563","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.110","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114563"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-880/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114564.json b/data/2026/CVE-2026-114564.json index 08720ce25d..9c17e6c566 100644 --- a/data/2026/CVE-2026-114564.json +++ b/data/2026/CVE-2026-114564.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30768."}],"id":"CVE-2026-114564","lastModified":"2026-11-12T03:17:09.250","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.250","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114564"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-881/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30768."}],"id":"CVE-2026-114564","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.250","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114564"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-881/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114565.json b/data/2026/CVE-2026-114565.json index 40707eb123..815eaafb10 100644 --- a/data/2026/CVE-2026-114565.json +++ b/data/2026/CVE-2026-114565.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30769."}],"id":"CVE-2026-114565","lastModified":"2026-11-12T03:17:09.397","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.397","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114565"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-882/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30769."}],"id":"CVE-2026-114565","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.397","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114565"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-882/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114566.json b/data/2026/CVE-2026-114566.json index de0c78e685..ff75af21b4 100644 --- a/data/2026/CVE-2026-114566.json +++ b/data/2026/CVE-2026-114566.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30770."}],"id":"CVE-2026-114566","lastModified":"2026-11-12T03:17:09.527","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.527","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114566"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-883/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30770."}],"id":"CVE-2026-114566","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.527","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114566"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-883/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114567.json b/data/2026/CVE-2026-114567.json index 2e51e05ddb..2a48624907 100644 --- a/data/2026/CVE-2026-114567.json +++ b/data/2026/CVE-2026-114567.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30771."}],"id":"CVE-2026-114567","lastModified":"2026-11-12T03:17:09.657","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.657","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114567"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-884/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30771."}],"id":"CVE-2026-114567","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.657","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114567"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-884/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114568.json b/data/2026/CVE-2026-114568.json index 0dcd6ff05b..156ad0d041 100644 --- a/data/2026/CVE-2026-114568.json +++ b/data/2026/CVE-2026-114568.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJ File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31587."}],"id":"CVE-2026-114568","lastModified":"2026-11-12T03:17:09.783","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.783","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114568"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-885/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OPJ File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OPJ files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31587."}],"id":"CVE-2026-114568","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.783","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114568"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-885/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114569.json b/data/2026/CVE-2026-114569.json index dbb7cbdb3b..88f9f99339 100644 --- a/data/2026/CVE-2026-114569.json +++ b/data/2026/CVE-2026-114569.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30430."}],"id":"CVE-2026-114569","lastModified":"2026-11-12T03:17:09.917","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.917","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114569"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-875/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Origin Viewer","vendor":"OriginLab","versions":[{"status":"affected","version":"9.9.5"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of OGWU files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30430."}],"id":"CVE-2026-114569","lastModified":"2026-11-12T18:46:04.417","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:09.917","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://docs.originlab.com/cve/CVE-2026-114569"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-875/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-114594.json b/data/2026/CVE-2026-114594.json index e078c72377..3fe6cf3ad0 100644 --- a/data/2026/CVE-2026-114594.json +++ b/data/2026/CVE-2026-114594.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Sandisk Dashboard","vendor":"Sandisk","versions":[{"lessThanOrEqual":"5.2.2.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"634960e2-700d-44e8-9cc5-06f1161e61db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3."}],"id":"CVE-2026-114594","lastModified":"2026-11-09T17:17:10.583","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"634960e2-700d-44e8-9cc5-06f1161e61db","type":"Secondary"}]},"published":"2026-11-09T17:17:10.583","references":[{"source":"634960e2-700d-44e8-9cc5-06f1161e61db","url":"https://www.sandisk.com/support/product-security/sdc-26001-sandisk-dashboard-app-version-5-3-2-4"}],"sourceIdentifier":"634960e2-700d-44e8-9cc5-06f1161e61db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-379"}],"source":"634960e2-700d-44e8-9cc5-06f1161e61db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Sandisk Dashboard","vendor":"Sandisk","versions":[{"lessThanOrEqual":"5.2.2.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"634960e2-700d-44e8-9cc5-06f1161e61db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3."}],"id":"CVE-2026-114594","lastModified":"2026-11-12T17:17:24.167","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"634960e2-700d-44e8-9cc5-06f1161e61db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:43:46.843251Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:10.583","references":[{"source":"634960e2-700d-44e8-9cc5-06f1161e61db","url":"https://www.sandisk.com/support/product-security/sdc-26001-sandisk-dashboard-app-version-5-3-2-4"}],"sourceIdentifier":"634960e2-700d-44e8-9cc5-06f1161e61db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-379"}],"source":"634960e2-700d-44e8-9cc5-06f1161e61db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114627.json b/data/2026/CVE-2026-114627.json index fdc63cd4a4..ab1e20be04 100644 --- a/data/2026/CVE-2026-114627.json +++ b/data/2026/CVE-2026-114627.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Web::Simple"],"packageName":"Web-Simple","packageURL":"pkg:cpan/Web-Simple","programFiles":["lib/XML/Tags.pm"],"programRoutines":[{"name":"XML::Tags::StringThing::stringify"}],"repo":"https://github.com/p5sagit/Web-Simple","versions":[{"lessThan":"0.036","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\n\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in

, $value,

, is entity-escaped, but the same value in \"Hello $value\" is not.\n\nAn attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page."}],"id":"CVE-2026-114627","lastModified":"2026-11-10T13:18:21.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:40:58.429963Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:35.167","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/ETHER/Web-Simple-0.036/changes"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/04/5"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Web::Simple"],"packageName":"Web-Simple","packageURL":"pkg:cpan/Web-Simple","programFiles":["lib/XML/Tags.pm"],"programRoutines":[{"name":"XML::Tags::StringThing::stringify"}],"repo":"https://github.com/p5sagit/Web-Simple","versions":[{"lessThan":"0.036","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output.\n\nUnder use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value as a separate part. The escaping step passes such objects through, and stringify joins their interpolated parts as is. A value passed on its own, as in

, $value,

, is entity-escaped, but the same value in \"Hello $value\" is not.\n\nAn attacker who controls a value that an application interpolates into a double-quoted string can inject script into the generated page."}],"id":"CVE-2026-114627","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:40:58.429963Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:35.167","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/p5sagit/Web-Simple/commit/01e575827fdd9ba3a08063fd414b1de465380015.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/ETHER/Web-Simple-0.036/changes"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/04/5"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114690.json b/data/2026/CVE-2026-114690.json index 8aeee5cc90..0453272d07 100644 --- a/data/2026/CVE-2026-114690.json +++ b/data/2026/CVE-2026-114690.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}],"id":"CVE-2026-114690","lastModified":"2026-11-11T19:17:29.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T15:20:50.353340Z","version":"2.0.3"}}]},"published":"2026-10-30T08:16:55.047","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98115"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114690"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478652"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}],"id":"CVE-2026-114690","lastModified":"2026-11-12T18:17:14.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T15:20:50.353340Z","version":"2.0.3"}}]},"published":"2026-10-30T08:16:55.047","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98115"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114690"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478652"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114691.json b/data/2026/CVE-2026-114691.json index 57ecabf133..16335496f2 100644 --- a/data/2026/CVE-2026-114691.json +++ b/data/2026/CVE-2026-114691.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}],"id":"CVE-2026-114691","lastModified":"2026-11-11T19:17:29.640","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T16:58:15.100212Z","version":"2.0.3"}}]},"published":"2026-10-30T08:16:55.257","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98115"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114691"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478508"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}],"id":"CVE-2026-114691","lastModified":"2026-11-12T18:17:14.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T16:58:15.100212Z","version":"2.0.3"}}]},"published":"2026-10-30T08:16:55.257","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98115"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114691"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478508"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114713.json b/data/2026/CVE-2026-114713.json index fa38fd517b..2408672a78 100644 --- a/data/2026/CVE-2026-114713.json +++ b/data/2026/CVE-2026-114713.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["labeled-response"],"product":"UnrealIRCd","programFiles":["src/modules/labeled-response.c"],"programRoutines":[{"name":"labeled_response_mtag_is_ok()"}],"repo":"https://github.com/unrealircd/unrealircd","vendor":"UnrealIRCd","versions":[{"lessThan":"6.2.7.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority."}],"id":"CVE-2026-114713","lastModified":"2026-11-08T11:16:32.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"cve@mitre.org","type":"Secondary"}]},"published":"2026-11-08T03:16:33.410","references":[{"source":"cve@mitre.org","url":"https://forums.unrealircd.org/viewtopic.php?t=9487"},{"source":"cve@mitre.org","url":"https://www.unrealircd.org/"},{"source":"cve@mitre.org","url":"https://www.unrealircd.org/index/news"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/08/1"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-140"}],"source":"cve@mitre.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["labeled-response"],"product":"UnrealIRCd","programFiles":["src/modules/labeled-response.c"],"programRoutines":[{"name":"labeled_response_mtag_is_ok()"}],"repo":"https://github.com/unrealircd/unrealircd","vendor":"UnrealIRCd","versions":[{"lessThan":"6.2.7.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 \"label\" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority."}],"id":"CVE-2026-114713","lastModified":"2026-11-12T20:18:16.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114713","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:55:27.812651Z","version":"2.0.3"}}]},"published":"2026-11-08T03:16:33.410","references":[{"source":"cve@mitre.org","url":"https://forums.unrealircd.org/viewtopic.php?t=9487"},{"source":"cve@mitre.org","url":"https://www.unrealircd.org/"},{"source":"cve@mitre.org","url":"https://www.unrealircd.org/index/news"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/08/1"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-140"}],"source":"cve@mitre.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115336.json b/data/2026/CVE-2026-115336.json index d5a0d63763..cb9f18d6c6 100644 --- a/data/2026/CVE-2026-115336.json +++ b/data/2026/CVE-2026-115336.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"WS_FTP Server","vendor":"Progress Software","versions":[{"lessThan":"2025.0.5","status":"affected","version":"2025.0.0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service."}],"id":"CVE-2026-115336","lastModified":"2026-11-09T17:17:11.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-09T17:17:10.903","references":[{"source":"security@progress.com","url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-682"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"WS_FTP Server","vendor":"Progress Software","versions":[{"lessThan":"2025.0.5","status":"affected","version":"2025.0.0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service."}],"id":"CVE-2026-115336","lastModified":"2026-11-12T17:17:24.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115336","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:01:46.220349Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:10.903","references":[{"source":"security@progress.com","url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-682"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115339.json b/data/2026/CVE-2026-115339.json index e135905a54..6d75dbf358 100644 --- a/data/2026/CVE-2026-115339.json +++ b/data/2026/CVE-2026-115339.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"WS_FTP Server","vendor":"Progress Software","versions":[{"lessThan":"2025.0.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service."}],"id":"CVE-2026-115339","lastModified":"2026-11-09T17:17:11.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-09T17:17:11.380","references":[{"source":"security@progress.com","url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"WS_FTP Server","vendor":"Progress Software","versions":[{"lessThan":"2025.0.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service."}],"id":"CVE-2026-115339","lastModified":"2026-11-12T17:17:24.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115339","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:02:35.221415Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:11.380","references":[{"source":"security@progress.com","url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115340.json b/data/2026/CVE-2026-115340.json index 90f8c3d405..aed69892b5 100644 --- a/data/2026/CVE-2026-115340.json +++ b/data/2026/CVE-2026-115340.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"WS_FTP Server","vendor":"Progress Software","versions":[{"lessThan":"2025.0.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations."}],"id":"CVE-2026-115340","lastModified":"2026-11-09T17:17:11.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-09T17:17:11.520","references":[{"source":"security@progress.com","url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"},{"lang":"en","value":"CWE-522"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"WS_FTP Server","vendor":"Progress Software","versions":[{"lessThan":"2025.0.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations."}],"id":"CVE-2026-115340","lastModified":"2026-11-12T17:17:24.640","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"security@progress.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115340","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:47:38.585254Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:11.520","references":[{"source":"security@progress.com","url":"https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2026"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"},{"lang":"en","value":"CWE-522"}],"source":"security@progress.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115455.json b/data/2026/CVE-2026-115455.json index 2cf82f456c..685860fff9 100644 --- a/data/2026/CVE-2026-115455.json +++ b/data/2026/CVE-2026-115455.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"13.5.0-0.4.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}],"id":"CVE-2026-115455","lastModified":"2026-11-11T19:17:29.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T02:04:06.865957Z","version":"2.0.3"}}]},"published":"2026-10-30T08:16:55.463","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94989"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-115455"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562933"},{"source":"secalert@redhat.com","url":"https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"13.5.0-0.4.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}],"id":"CVE-2026-115455","lastModified":"2026-11-12T18:17:14.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T02:04:06.865957Z","version":"2.0.3"}}]},"published":"2026-10-30T08:16:55.463","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94989"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-115455"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562933"},{"source":"secalert@redhat.com","url":"https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115456.json b/data/2026/CVE-2026-115456.json index 2c659736fe..246f03a46a 100644 --- a/data/2026/CVE-2026-115456.json +++ b/data/2026/CVE-2026-115456.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}],"id":"CVE-2026-115456","lastModified":"2026-11-11T20:17:05.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T15:28:14.595258Z","version":"2.0.3"}}]},"published":"2026-10-30T09:17:14.413","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-115456"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563044"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}],"id":"CVE-2026-115456","lastModified":"2026-11-12T18:17:15.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T15:28:14.595258Z","version":"2.0.3"}}]},"published":"2026-10-30T09:17:14.413","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-115456"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563044"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115473.json b/data/2026/CVE-2026-115473.json index 523b912aab..c26a6fafbf 100644 --- a/data/2026/CVE-2026-115473.json +++ b/data/2026/CVE-2026-115473.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"mongoose","vendor":"cesanta","versions":[{"status":"affected","version":"< 7.22"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22."}],"id":"CVE-2026-115473","lastModified":"2026-11-05T20:17:42.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115473","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:02:05.668751Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:50.503","references":[{"source":"security-advisories@github.com","url":"https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc"},{"source":"security-advisories@github.com","url":"https://github.com/cesanta/mongoose/releases/tag/7.22"},{"source":"security-advisories@github.com","url":"https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-158"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"mongoose","vendor":"cesanta","versions":[{"status":"affected","version":"< 7.22"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22."}],"id":"CVE-2026-115473","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115473","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:02:05.668751Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:50.503","references":[{"source":"security-advisories@github.com","url":"https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc"},{"source":"security-advisories@github.com","url":"https://github.com/cesanta/mongoose/releases/tag/7.22"},{"source":"security-advisories@github.com","url":"https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-158"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115538.json b/data/2026/CVE-2026-115538.json index 483b56e356..a31ad5d0fb 100644 --- a/data/2026/CVE-2026-115538.json +++ b/data/2026/CVE-2026-115538.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"Docker Engine","vendor":"Docker","versions":[{"lessThan":"29.9.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageName":"github.com/moby/moby/v2","platforms":["Linux"],"product":"Moby","vendor":"Moby","versions":[{"lessThan":"v2.0.0-beta.29","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition."}],"id":"CVE-2026-115538","lastModified":"2026-11-10T20:18:03.747","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-10T20:18:03.747","references":[{"source":"security@docker.com","url":"https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"security@docker.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"Docker Engine","vendor":"Docker","versions":[{"lessThan":"29.9.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageName":"github.com/moby/moby/v2","platforms":["Linux"],"product":"Moby","vendor":"Moby","versions":[{"lessThan":"v2.0.0-beta.29","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition."}],"id":"CVE-2026-115538","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-10T20:18:03.747","references":[{"source":"security@docker.com","url":"https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"security@docker.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115539.json b/data/2026/CVE-2026-115539.json index 8199db1500..d7dcfc4702 100644 --- a/data/2026/CVE-2026-115539.json +++ b/data/2026/CVE-2026-115539.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"github.com/moby/swarmkit/v2","product":"SwarmKit","vendor":"moby","versions":[{"lessThan":"2.1.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageName":"github.com/docker/docker","product":"Docker Engine","vendor":"Docker","versions":[{"lessThan":"*","status":"affected","version":"23.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageName":"github.com/moby/moby/v2","product":"Moby","vendor":"moby","versions":[{"lessThanOrEqual":"2.0.0-beta.28","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageName":"github.com/moby/swarmkit","product":"SwarmKit","vendor":"moby","versions":[{"lessThan":"*","status":"affected","version":"1.12.1-0.20220307221335-616e8db4c3b0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted."}],"id":"CVE-2026-115539","lastModified":"2026-11-10T20:18:03.897","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-10T20:18:03.897","references":[{"source":"security@docker.com","url":"https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"security@docker.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"github.com/moby/swarmkit/v2","product":"SwarmKit","vendor":"moby","versions":[{"lessThan":"2.1.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageName":"github.com/docker/docker","product":"Docker Engine","vendor":"Docker","versions":[{"lessThan":"*","status":"affected","version":"23.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageName":"github.com/moby/moby/v2","product":"Moby","vendor":"moby","versions":[{"lessThanOrEqual":"2.0.0-beta.28","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageName":"github.com/moby/swarmkit","product":"SwarmKit","vendor":"moby","versions":[{"lessThan":"*","status":"affected","version":"1.12.1-0.20220307221335-616e8db4c3b0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted."}],"id":"CVE-2026-115539","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-10T20:18:03.897","references":[{"source":"security@docker.com","url":"https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"security@docker.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115541.json b/data/2026/CVE-2026-115541.json index a3d4d32056..2dd92492a3 100644 --- a/data/2026/CVE-2026-115541.json +++ b/data/2026/CVE-2026-115541.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"product":"HumHub Community Edition","repo":"https://github.com/humhub/humhub","vendor":"HumHub","versions":[{"lessThan":"1.18.7","status":"affected","version":"0","versionType":"semver"},{"lessThan":"1.19.1","status":"affected","version":"1.19.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin."}],"id":"CVE-2026-115541","lastModified":"2026-11-06T20:17:11.063","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:33:12.611938Z","version":"2.0.3"}}]},"published":"2026-11-03T22:19:17.723","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/toujours"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub/pull/8624"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub/pull/8625"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub/releases/tag/v1.18.7"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub/releases/tag/v1.19.3"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub/security/advisories/GHSA-ph8x-wg86-qp2m"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"product":"HumHub Community Edition","repo":"https://github.com/humhub/humhub","vendor":"HumHub","versions":[{"lessThan":"1.18.7","status":"affected","version":"0","versionType":"semver"},{"lessThan":"1.19.1","status":"affected","version":"1.19.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin."}],"id":"CVE-2026-115541","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:33:12.611938Z","version":"2.0.3"}}]},"published":"2026-11-03T22:19:17.723","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/toujours"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub/pull/8624"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub/pull/8625"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub/releases/tag/v1.18.7"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub/releases/tag/v1.19.3"},{"source":"help@fluidattacks.com","url":"https://github.com/humhub/humhub/security/advisories/GHSA-ph8x-wg86-qp2m"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115640.json b/data/2026/CVE-2026-115640.json index 3711a24e3d..3334bc4544 100644 --- a/data/2026/CVE-2026-115640.json +++ b/data/2026/CVE-2026-115640.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"product":"LimeSurvey Community Edition","repo":"https://github.com/LimeSurvey/LimeSurvey","vendor":"LimeSurvey","versions":[{"lessThanOrEqual":"7.7.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participant_id and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions."}],"id":"CVE-2026-115640","lastModified":"2026-11-10T20:18:04.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115640","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:33:07.267402Z","version":"2.0.3"}}]},"published":"2026-11-10T05:17:47.300","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/es/advisories/angel"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/commit/4cd281828422abf94468052016eba8897d5ec9aa"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/releases/tag/7.9.0+261029"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"product":"LimeSurvey Community Edition","repo":"https://github.com/LimeSurvey/LimeSurvey","vendor":"LimeSurvey","versions":[{"lessThanOrEqual":"7.7.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participant_id and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions."}],"id":"CVE-2026-115640","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115640","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:33:07.267402Z","version":"2.0.3"}}]},"published":"2026-11-10T05:17:47.300","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/es/advisories/angel"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/commit/4cd281828422abf94468052016eba8897d5ec9aa"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/releases/tag/7.9.0+261029"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115701.json b/data/2026/CVE-2026-115701.json index db0d5e9782..e827150970 100644 --- a/data/2026/CVE-2026-115701.json +++ b/data/2026/CVE-2026-115701.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["cowboy_http"],"packageName":"cowboy","packageURL":"pkg:hex/cowboy","product":"cowboy","programFiles":["src/cowboy_http.erl"],"programRoutines":[{"name":"cowboy_http:parse/2"},{"name":"cowboy_http:loop/1"}],"repo":"https://github.com/ninenines/cowboy","vendor":"ninenines","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.18.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["cowboy_http"],"packageName":"ninenines/cowboy","packageURL":"pkg:github/ninenines/cowboy","product":"cowboy","programFiles":["src/cowboy_http.erl"],"programRoutines":[{"name":"cowboy_http:parse/2"},{"name":"cowboy_http:loop/1"}],"repo":"https://github.com/ninenines/cowboy","vendor":"ninenines","versions":[{"lessThan":"3a630c07e1521abf63a1b9ea080509aa1337b60d","status":"affected","version":"faf5594fbf74530ace90b0c46c936bdc2cf82081","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.\n\nOnce a request has been received in full and its handler is still running, cowboy_http:parse/2 in src/cowboy_http.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: max_request_line_length, max_headers and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idle_timeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions.\n\nThis issue affects cowboy: from 2.18.0 before 2.21.0."}],"id":"CVE-2026-115701","lastModified":"2026-11-10T15:17:13.217","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:01:56.291118Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:05.223","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-115701.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ninenines/cowboy/commit/3a630c07e1521abf63a1b9ea080509aa1337b60d"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ninenines/cowboy/commit/faf5594fbf74530ace90b0c46c936bdc2cf82081"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-115701"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["cowboy_http"],"packageName":"cowboy","packageURL":"pkg:hex/cowboy","product":"cowboy","programFiles":["src/cowboy_http.erl"],"programRoutines":[{"name":"cowboy_http:parse/2"},{"name":"cowboy_http:loop/1"}],"repo":"https://github.com/ninenines/cowboy","vendor":"ninenines","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.18.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:ninenines:cowboy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["cowboy_http"],"packageName":"ninenines/cowboy","packageURL":"pkg:github/ninenines/cowboy","product":"cowboy","programFiles":["src/cowboy_http.erl"],"programRoutines":[{"name":"cowboy_http:parse/2"},{"name":"cowboy_http:loop/1"}],"repo":"https://github.com/ninenines/cowboy","vendor":"ninenines","versions":[{"lessThan":"3a630c07e1521abf63a1b9ea080509aa1337b60d","status":"affected","version":"faf5594fbf74530ace90b0c46c936bdc2cf82081","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.\n\nOnce a request has been received in full and its handler is still running, cowboy_http:parse/2 in src/cowboy_http.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: max_request_line_length, max_headers and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idle_timeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions.\n\nThis issue affects cowboy: from 2.18.0 before 2.21.0."}],"id":"CVE-2026-115701","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:01:56.291118Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:05.223","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-115701.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ninenines/cowboy/commit/3a630c07e1521abf63a1b9ea080509aa1337b60d"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ninenines/cowboy/commit/faf5594fbf74530ace90b0c46c936bdc2cf82081"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-115701"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115733.json b/data/2026/CVE-2026-115733.json index a6e8ef511d..52abf7788f 100644 --- a/data/2026/CVE-2026-115733.json +++ b/data/2026/CVE-2026-115733.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Printaura-Woocommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks."}],"id":"CVE-2026-115733","lastModified":"2026-11-11T12:18:53.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115733","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:45.567780Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:13.607","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/dac80e74-ecfc-49e2-82a9-0c70285de1c1/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Printaura-Woocommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks."}],"id":"CVE-2026-115733","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115733","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:45.567780Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:13.607","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/dac80e74-ecfc-49e2-82a9-0c70285de1c1/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115734.json b/data/2026/CVE-2026-115734.json index 7b47b1a7ab..ea35f421c4 100644 --- a/data/2026/CVE-2026-115734.json +++ b/data/2026/CVE-2026-115734.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Pay with a tweet","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise."}],"id":"CVE-2026-115734","lastModified":"2026-11-11T12:18:53.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115734","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:32.396394Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:13.753","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/73fea81f-2611-4230-a159-c182c3045f2d/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Pay with a tweet","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise."}],"id":"CVE-2026-115734","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115734","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:32.396394Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:13.753","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/73fea81f-2611-4230-a159-c182c3045f2d/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115735.json b/data/2026/CVE-2026-115735.json index 12f759eba0..a0ffd026f6 100644 --- a/data/2026/CVE-2026-115735.json +++ b/data/2026/CVE-2026-115735.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Somatic Framework","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.8.14","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover."}],"id":"CVE-2026-115735","lastModified":"2026-11-11T12:18:54.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115735","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:22.979200Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:13.893","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/0a43de6d-7b65-4cc6-b02a-479bb79293cc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Somatic Framework","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.8.14","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover."}],"id":"CVE-2026-115735","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115735","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:22.979200Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:13.893","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/0a43de6d-7b65-4cc6-b02a-479bb79293cc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115762.json b/data/2026/CVE-2026-115762.json index 3cb99a8b0e..3a206ad731 100644 --- a/data/2026/CVE-2026-115762.json +++ b/data/2026/CVE-2026-115762.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"drawio","vendor":"jgraph","versions":[{"status":"affected","version":"< 31.1.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign attacker-controlled attributes to those objects. Importing a malicious GraphML file can trigger client-side prototype pollution. In the advisory-supported cross-site scripting chain, the editor is opened in Trello mode and the user invokes the Trello integration after the import, allowing the polluted state to execute script in the draw.io origin; an existing Trello connection is not required. This vulnerability is fixed in 31.1.5."}],"id":"CVE-2026-115762","lastModified":"2026-11-09T17:17:11.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115762","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:09:32.044189Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:52.347","references":[{"source":"security-advisories@github.com","url":"https://github.com/jgraph/drawio/commit/3b4210678207f3880888969ee53c9fe4580104ab"},{"source":"security-advisories@github.com","url":"https://github.com/jgraph/drawio/security/advisories/GHSA-vvpv-f297-2ghp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"drawio","vendor":"jgraph","versions":[{"status":"affected","version":"< 31.1.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign attacker-controlled attributes to those objects. Importing a malicious GraphML file can trigger client-side prototype pollution. In the advisory-supported cross-site scripting chain, the editor is opened in Trello mode and the user invokes the Trello integration after the import, allowing the polluted state to execute script in the draw.io origin; an existing Trello connection is not required. This vulnerability is fixed in 31.1.5."}],"id":"CVE-2026-115762","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115762","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:09:32.044189Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:52.347","references":[{"source":"security-advisories@github.com","url":"https://github.com/jgraph/drawio/commit/3b4210678207f3880888969ee53c9fe4580104ab"},{"source":"security-advisories@github.com","url":"https://github.com/jgraph/drawio/security/advisories/GHSA-vvpv-f297-2ghp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115779.json b/data/2026/CVE-2026-115779.json index 2c9004137a..3dbc0ac9bc 100644 --- a/data/2026/CVE-2026-115779.json +++ b/data/2026/CVE-2026-115779.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"effect","vendor":"Effect-TS","versions":[{"status":"affected","version":">= 4.0.0-beta.0, < 4.0.0-beta.103"}]},{"product":"platform","vendor":"@effect","versions":[{"status":"affected","version":">= 0.1.0, < 0.97.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103."}],"id":"CVE-2026-115779","lastModified":"2026-11-03T22:19:17.923","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115779","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T21:26:42.883505Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:02.190","references":[{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/pull/6763"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/pull/6765"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"effect","vendor":"Effect-TS","versions":[{"status":"affected","version":">= 4.0.0-beta.0, < 4.0.0-beta.103"}]},{"product":"platform","vendor":"@effect","versions":[{"status":"affected","version":">= 0.1.0, < 0.97.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103."}],"id":"CVE-2026-115779","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115779","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T21:26:42.883505Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:02.190","references":[{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/pull/6763"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/pull/6765"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103"},{"source":"security-advisories@github.com","url":"https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115864.json b/data/2026/CVE-2026-115864.json index 17db90be33..0adb367951 100644 --- a/data/2026/CVE-2026-115864.json +++ b/data/2026/CVE-2026-115864.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Monoceros"],"packageName":"Monoceros","packageURL":"pkg:cpan/Monoceros","programFiles":["lib/Monoceros/Server.pm"],"programRoutines":[{"name":"Monoceros::Server::handle_connection"}],"repo":"https://github.com/kazeburo/Monoceros","versions":[{"lessThan":"0.30","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.\n\nThe request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.\n\nA remote attacker can force a worker restart with each request of a few bytes."}],"id":"CVE-2026-115864","lastModified":"2026-11-10T01:17:15.747","metrics":{},"published":"2026-11-09T22:18:28.247","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/kazeburo/Monoceros/commit/897a4a9624329fc0a4b2352d387bdac6d37848e2.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/KAZEBURO/Monoceros-0.30/changes"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/32"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Monoceros"],"packageName":"Monoceros","packageURL":"pkg:cpan/Monoceros","programFiles":["lib/Monoceros/Server.pm"],"programRoutines":[{"name":"Monoceros::Server::handle_connection"}],"repo":"https://github.com/kazeburo/Monoceros","versions":[{"lessThan":"0.30","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory.\n\nThe request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.\n\nA remote attacker can force a worker restart with each request of a few bytes."}],"id":"CVE-2026-115864","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115864","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:07:56.467802Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:28.247","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/kazeburo/Monoceros/commit/897a4a9624329fc0a4b2352d387bdac6d37848e2.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/KAZEBURO/Monoceros-0.30/changes"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/32"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115878.json b/data/2026/CVE-2026-115878.json index 0a501382de..bf08de940d 100644 --- a/data/2026/CVE-2026-115878.json +++ b/data/2026/CVE-2026-115878.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"stanza","vendor":"stanfordnlp","versions":[{"status":"affected","version":"= 1.14.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0."}],"id":"CVE-2026-115878","lastModified":"2026-11-03T23:17:30.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T22:36:42.446948Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:02.377","references":[{"source":"security-advisories@github.com","url":"https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0"},{"source":"security-advisories@github.com","url":"https://github.com/stanfordnlp/stanza/pull/1649"},{"source":"security-advisories@github.com","url":"https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0"},{"source":"security-advisories@github.com","url":"https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-502"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"stanza","vendor":"stanfordnlp","versions":[{"status":"affected","version":"= 1.14.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0."}],"id":"CVE-2026-115878","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T22:36:42.446948Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:02.377","references":[{"source":"security-advisories@github.com","url":"https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0"},{"source":"security-advisories@github.com","url":"https://github.com/stanfordnlp/stanza/pull/1649"},{"source":"security-advisories@github.com","url":"https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0"},{"source":"security-advisories@github.com","url":"https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-502"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115934.json b/data/2026/CVE-2026-115934.json index 14e75610f7..83e463f7ba 100644 --- a/data/2026/CVE-2026-115934.json +++ b/data/2026/CVE-2026-115934.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://packagist.org","defaultStatus":"unaffected","packageName":"craftcms/cms","product":"cms","vendor":"craftcms","versions":[{"lessThan":"5.11.2","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThan":"4.18.9","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator.\n\n\n\nNote that this only affects MySQL/MariaDB.\n\nImpact * SQL injection — The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database.\n * Privilege escalation to administrator — The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account’s password hash.\n\n\n\n\nUpdate to the patched versions (4.18.9 and 5.11.2) to get the fix.\n\n\n\nIf you cannot update immediately, you can block front-end requests with %5Battribute%5D and [attribute] anywhere in the query string as a temporary mitigation."}],"id":"CVE-2026-115934","lastModified":"2026-11-10T21:46:26.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"ATTACKED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary"}]},"published":"2026-11-09T23:17:12.470","references":[{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","url":"https://github.com/craftcms/cms"},{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","url":"https://github.com/craftcms/cms/releases/tag/5.11.2"},{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6"},{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","url":"https://www.hckrt.com/hacktivity/HCKRT-Y64NY8"}],"sourceIdentifier":"7004884b-51e2-48e8-b4a2-5ca29e80453e","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://packagist.org","defaultStatus":"unaffected","packageName":"craftcms/cms","product":"cms","vendor":"craftcms","versions":[{"lessThan":"5.11.2","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThan":"4.18.9","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator.\n\n\n\nNote that this only affects MySQL/MariaDB.\n\nImpact * SQL injection — The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database.\n * Privilege escalation to administrator — The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account’s password hash.\n\n\n\n\nUpdate to the patched versions (4.18.9 and 5.11.2) to get the fix.\n\n\n\nIf you cannot update immediately, you can block front-end requests with %5Battribute%5D and [attribute] anywhere in the query string as a temporary mitigation."}],"id":"CVE-2026-115934","lastModified":"2026-11-12T17:17:25.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"ATTACKED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115934","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:05:57.922658Z","version":"2.0.3"}}]},"published":"2026-11-09T23:17:12.470","references":[{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","url":"https://github.com/craftcms/cms"},{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","url":"https://github.com/craftcms/cms/releases/tag/5.11.2"},{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6"},{"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","url":"https://www.hckrt.com/hacktivity/HCKRT-Y64NY8"}],"sourceIdentifier":"7004884b-51e2-48e8-b4a2-5ca29e80453e","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"7004884b-51e2-48e8-b4a2-5ca29e80453e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116081.json b/data/2026/CVE-2026-116081.json index c56b4653ac..c1555e8b54 100644 --- a/data/2026/CVE-2026-116081.json +++ b/data/2026/CVE-2026-116081.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Sleipnir Mobile for iPhone / iPad","vendor":"Fenrir Inc.","versions":[{"lessThanOrEqual":"v4.15.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Sleipnir Mobile for iPhone / iPad Black Edition","vendor":"Fenrir Inc.","versions":[{"lessThanOrEqual":"v4.15.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sleipnir Mobile for iPhone / iPad and Sleipnir Mobile for iPhone / iPad Black Edition provided by Fenrir Inc. are vulnerable to improper certificate verification. A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication."}],"id":"CVE-2026-116081","lastModified":"2026-11-11T06:17:14.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}]},"published":"2026-11-11T06:17:14.030","references":[{"source":"vultures@jpcert.or.jp","url":"https://apps.apple.com/jp/app/sleipnir-mobile-black-edition/id461181338"},{"source":"vultures@jpcert.or.jp","url":"https://apps.apple.com/us/app/sleipnir-mobile/id404732112"},{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/vu/JVNVU93068550/"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"vultures@jpcert.or.jp","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Sleipnir Mobile for iPhone / iPad","vendor":"Fenrir Inc.","versions":[{"lessThanOrEqual":"v4.15.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Sleipnir Mobile for iPhone / iPad Black Edition","vendor":"Fenrir Inc.","versions":[{"lessThanOrEqual":"v4.15.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sleipnir Mobile for iPhone / iPad and Sleipnir Mobile for iPhone / iPad Black Edition provided by Fenrir Inc. are vulnerable to improper certificate verification. A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication."}],"id":"CVE-2026-116081","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}]},"published":"2026-11-11T06:17:14.030","references":[{"source":"vultures@jpcert.or.jp","url":"https://apps.apple.com/jp/app/sleipnir-mobile-black-edition/id461181338"},{"source":"vultures@jpcert.or.jp","url":"https://apps.apple.com/us/app/sleipnir-mobile/id404732112"},{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/vu/JVNVU93068550/"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"vultures@jpcert.or.jp","type":"Primary"}]} diff --git a/data/2026/CVE-2026-116303.json b/data/2026/CVE-2026-116303.json index 99f0c38e01..cc054eb53c 100644 --- a/data/2026/CVE-2026-116303.json +++ b/data/2026/CVE-2026-116303.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found. There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116303","lastModified":"2026-11-12T15:17:37.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:37.910","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116303/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found. There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116303","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:37.910","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116303/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116304.json b/data/2026/CVE-2026-116304.json index cde1bbfdb6..88d7d46ff7 100644 --- a/data/2026/CVE-2026-116304.json +++ b/data/2026/CVE-2026-116304.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116304","lastModified":"2026-11-12T15:17:38.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.043","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116304/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116304","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.043","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116304/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116306.json b/data/2026/CVE-2026-116306.json index 86a756dfdc..cb363c3221 100644 --- a/data/2026/CVE-2026-116306.json +++ b/data/2026/CVE-2026-116306.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116306","lastModified":"2026-11-12T15:17:38.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.193","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116306/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116306","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.193","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116306/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116307.json b/data/2026/CVE-2026-116307.json index 7ed00b5728..ac843d952d 100644 --- a/data/2026/CVE-2026-116307.json +++ b/data/2026/CVE-2026-116307.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116307","lastModified":"2026-11-12T15:17:38.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.340","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116307/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116307","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.340","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116307/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116308.json b/data/2026/CVE-2026-116308.json index 3ddc5fec44..92b6a96778 100644 --- a/data/2026/CVE-2026-116308.json +++ b/data/2026/CVE-2026-116308.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116308","lastModified":"2026-11-12T15:17:38.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.490","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116308/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116308","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.490","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116308/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116309.json b/data/2026/CVE-2026-116309.json index e9a9f6d759..592ed368b9 100644 --- a/data/2026/CVE-2026-116309.json +++ b/data/2026/CVE-2026-116309.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116309","lastModified":"2026-11-12T15:17:38.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.647","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116309/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116309","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.647","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116309/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116310.json b/data/2026/CVE-2026-116310.json index da5f0b975f..9b17201df1 100644 --- a/data/2026/CVE-2026-116310.json +++ b/data/2026/CVE-2026-116310.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. file_fdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-116310","lastModified":"2026-11-12T15:17:38.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.810","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116310/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. file_fdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-116310","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.810","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116310/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116311.json b/data/2026/CVE-2026-116311.json index 53928d1b05..a425fd934c 100644 --- a/data/2026/CVE-2026-116311.json +++ b/data/2026/CVE-2026-116311.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116311","lastModified":"2026-11-12T15:17:39.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.007","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116311/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116311","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.007","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116311/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116312.json b/data/2026/CVE-2026-116312.json index 87dfb2b97e..cbcd9df092 100644 --- a/data/2026/CVE-2026-116312.json +++ b/data/2026/CVE-2026-116312.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE. Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected. Versions before PostgreSQL 15 are unaffected."}],"id":"CVE-2026-116312","lastModified":"2026-11-12T15:17:39.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.190","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116312/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1250"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE. Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected. Versions before PostgreSQL 15 are unaffected."}],"id":"CVE-2026-116312","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.190","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116312/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1250"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116313.json b/data/2026/CVE-2026-116313.json index 555831b1a6..9628912a59 100644 --- a/data/2026/CVE-2026-116313.json +++ b/data/2026/CVE-2026-116313.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116313","lastModified":"2026-11-12T15:17:39.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.347","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116313/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-426"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116313","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.347","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116313/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-426"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116314.json b/data/2026/CVE-2026-116314.json index 953819eade..cf96cbf493 100644 --- a/data/2026/CVE-2026-116314.json +++ b/data/2026/CVE-2026-116314.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116314","lastModified":"2026-11-12T15:17:39.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.500","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116314/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116314","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.500","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116314/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116315.json b/data/2026/CVE-2026-116315.json index f22ac66aab..6c2fded913 100644 --- a/data/2026/CVE-2026-116315.json +++ b/data/2026/CVE-2026-116315.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116315","lastModified":"2026-11-12T15:17:39.683","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.683","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116315/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116315","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.683","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116315/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116316.json b/data/2026/CVE-2026-116316.json index e52e893654..9ddde7db01 100644 --- a/data/2026/CVE-2026-116316.json +++ b/data/2026/CVE-2026-116316.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp. The victim session must later run a query containing an unqualified type name, e.g. \"SELECT '1'::bigint\"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116316","lastModified":"2026-11-12T15:17:39.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.837","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116316/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp. The victim session must later run a query containing an unqualified type name, e.g. \"SELECT '1'::bigint\"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116316","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.837","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116316/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116317.json b/data/2026/CVE-2026-116317.json index 09f157ce40..aa4c820415 100644 --- a/data/2026/CVE-2026-116317.json +++ b/data/2026/CVE-2026-116317.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116317","lastModified":"2026-11-12T15:17:39.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.993","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116317/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116317","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.993","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116317/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116318.json b/data/2026/CVE-2026-116318.json index 7b7de4596a..fbd461a0ab 100644 --- a/data/2026/CVE-2026-116318.json +++ b/data/2026/CVE-2026-116318.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116318","lastModified":"2026-11-12T15:17:40.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.147","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116318/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116318","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.147","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116318/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116319.json b/data/2026/CVE-2026-116319.json index 7035b8511e..873d746971 100644 --- a/data/2026/CVE-2026-116319.json +++ b/data/2026/CVE-2026-116319.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116319","lastModified":"2026-11-12T15:17:40.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.313","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116319/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116319","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.313","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116319/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116320.json b/data/2026/CVE-2026-116320.json index 1fd17f5e7b..cfd34d5cb9 100644 --- a/data/2026/CVE-2026-116320.json +++ b/data/2026/CVE-2026-116320.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116320","lastModified":"2026-11-12T15:17:40.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.430","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116320/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116320","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.430","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116320/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116321.json b/data/2026/CVE-2026-116321.json index 2e5ab7b607..b96143622f 100644 --- a/data/2026/CVE-2026-116321.json +++ b/data/2026/CVE-2026-116321.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116321","lastModified":"2026-11-12T15:17:40.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.577","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116321/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-170"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116321","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.577","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116321/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-170"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116322.json b/data/2026/CVE-2026-116322.json index 79b9542348..867ad5ad03 100644 --- a/data/2026/CVE-2026-116322.json +++ b/data/2026/CVE-2026-116322.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116322","lastModified":"2026-11-12T15:17:40.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.707","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116322/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116322","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.707","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116322/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116323.json b/data/2026/CVE-2026-116323.json index 35f564c20d..b77cfbaf18 100644 --- a/data/2026/CVE-2026-116323.json +++ b/data/2026/CVE-2026-116323.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116323","lastModified":"2026-11-12T15:17:40.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.823","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116323/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116323","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.823","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116323/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116325.json b/data/2026/CVE-2026-116325.json index bd6eb32a97..2d268066da 100644 --- a/data/2026/CVE-2026-116325.json +++ b/data/2026/CVE-2026-116325.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-116325","lastModified":"2026-11-12T15:17:40.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.947","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116325/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-116325","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.947","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116325/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116326.json b/data/2026/CVE-2026-116326.json index b9bc6f28a7..9d31291ea3 100644 --- a/data/2026/CVE-2026-116326.json +++ b/data/2026/CVE-2026-116326.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116326","lastModified":"2026-11-12T15:17:41.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.077","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116326/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116326","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.077","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116326/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116327.json b/data/2026/CVE-2026-116327.json index 426f7974af..cfec5a6910 100644 --- a/data/2026/CVE-2026-116327.json +++ b/data/2026/CVE-2026-116327.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116327","lastModified":"2026-11-12T15:17:41.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.197","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116327/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116327","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.197","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116327/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116328.json b/data/2026/CVE-2026-116328.json index 93ae7a8d26..6e7fa8aff6 100644 --- a/data/2026/CVE-2026-116328.json +++ b/data/2026/CVE-2026-116328.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."}],"id":"CVE-2026-116328","lastModified":"2026-11-12T15:17:41.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.313","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116328/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."}],"id":"CVE-2026-116328","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.313","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116328/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116329.json b/data/2026/CVE-2026-116329.json index 04e013596b..701b3f1143 100644 --- a/data/2026/CVE-2026-116329.json +++ b/data/2026/CVE-2026-116329.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116329","lastModified":"2026-11-12T15:17:41.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.437","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116329/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116329","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.437","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116329/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116330.json b/data/2026/CVE-2026-116330.json index 6deb5e17b2..0f6b340156 100644 --- a/data/2026/CVE-2026-116330.json +++ b/data/2026/CVE-2026-116330.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116330","lastModified":"2026-11-12T15:17:41.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.557","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116330/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116330","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.557","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116330/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116331.json b/data/2026/CVE-2026-116331.json index 562d00c306..376d4739c9 100644 --- a/data/2026/CVE-2026-116331.json +++ b/data/2026/CVE-2026-116331.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116331","lastModified":"2026-11-12T15:17:41.683","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.683","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116331/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116331","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.683","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116331/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116332.json b/data/2026/CVE-2026-116332.json index 3b505e031d..997877eccb 100644 --- a/data/2026/CVE-2026-116332.json +++ b/data/2026/CVE-2026-116332.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116332","lastModified":"2026-11-12T15:17:41.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.800","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116332/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116332","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.800","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116332/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116333.json b/data/2026/CVE-2026-116333.json index cd5577cde1..f22c523e23 100644 --- a/data/2026/CVE-2026-116333.json +++ b/data/2026/CVE-2026-116333.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-116333","lastModified":"2026-11-12T15:17:41.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.920","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116333/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-116333","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.920","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116333/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116335.json b/data/2026/CVE-2026-116335.json index 106c503c24..67f4f27c60 100644 --- a/data/2026/CVE-2026-116335.json +++ b/data/2026/CVE-2026-116335.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116335","lastModified":"2026-11-12T15:17:42.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.043","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116335/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116335","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.043","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116335/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116336.json b/data/2026/CVE-2026-116336.json index a7869ab247..4625d85c31 100644 --- a/data/2026/CVE-2026-116336.json +++ b/data/2026/CVE-2026-116336.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116336","lastModified":"2026-11-12T15:17:42.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.167","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116336/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"},{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116336","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.167","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116336/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"},{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116337.json b/data/2026/CVE-2026-116337.json index e435fa71aa..e8499ba120 100644 --- a/data/2026/CVE-2026-116337.json +++ b/data/2026/CVE-2026-116337.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["qtbase"],"product":"Qt Framework","vendor":"qt","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"python"},{"lessThan":"6.8.10","status":"affected","version":"4.5.0","versionType":"python"},{"lessThan":"6.12.1","status":"affected","version":"6.9.0","versionType":"python"}]}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module."}],"id":"CVE-2026-116337","lastModified":"2026-11-09T09:16:58.450","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":0.6,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"LOW"},"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]},"published":"2026-11-09T09:16:58.450","references":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtbase/+/774223"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtbase/+/774266"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-116337:"}],"sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["qtbase"],"product":"Qt Framework","vendor":"qt","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"python"},{"lessThan":"6.8.10","status":"affected","version":"4.5.0","versionType":"python"},{"lessThan":"6.12.1","status":"affected","version":"6.9.0","versionType":"python"}]}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module."}],"id":"CVE-2026-116337","lastModified":"2026-11-12T19:16:47.380","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":0.6,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"LOW"},"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116337","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:12:22.055259Z","version":"2.0.3"}}]},"published":"2026-11-09T09:16:58.450","references":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtbase/+/774223"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtbase/+/774266"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-116337:"}],"sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116468.json b/data/2026/CVE-2026-116468.json index 2553d0223d..05ce8ceb9d 100644 --- a/data/2026/CVE-2026-116468.json +++ b/data/2026/CVE-2026-116468.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"],"defaultStatus":"affected","packageName":"keycloak-services","product":"Red Hat Build of Keycloak","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat Build of Keycloak","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"defaultStatus":"unaffected","packageName":"keycloak-services","product":"Red Hat Single Sign-On 7","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm."}],"id":"CVE-2026-116468","lastModified":"2026-11-11T08:17:17.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.9,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T08:17:17.077","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-116468"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560575"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"],"defaultStatus":"affected","packageName":"keycloak-services","product":"Red Hat Build of Keycloak","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat Build of Keycloak","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"defaultStatus":"unaffected","packageName":"keycloak-services","product":"Red Hat Single Sign-On 7","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm."}],"id":"CVE-2026-116468","lastModified":"2026-11-12T20:18:16.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:33:19.013628Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:17.077","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-116468"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560575"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116472.json b/data/2026/CVE-2026-116472.json index 6b44ec8ab1..670452b528 100644 --- a/data/2026/CVE-2026-116472.json +++ b/data/2026/CVE-2026-116472.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ingress-nginx","vendor":"Kubernetes","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Rancher Prime RKE2 ingress-nginx","vendor":"SUSE","versions":[{"lessThan":"1.15.2-prime1","status":"affected","version":"0","versionType":"custom"}]}],"source":"jordan@liggitt.net"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.\n\nDue to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly.\n\nIn principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway."}],"id":"CVE-2026-116472","lastModified":"2026-11-06T20:39:15.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"jordan@liggitt.net","type":"Secondary"}]},"published":"2026-11-05T19:17:10.690","references":[{"source":"jordan@liggitt.net","url":"https://github.com/kubernetes/kubernetes/issues/143852"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/05/4"}],"sourceIdentifier":"jordan@liggitt.net","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"jordan@liggitt.net","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ingress-nginx","vendor":"Kubernetes","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Rancher Prime RKE2 ingress-nginx","vendor":"SUSE","versions":[{"lessThan":"1.15.2-prime1","status":"affected","version":"0","versionType":"custom"}]}],"source":"jordan@liggitt.net"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of the ingress-nginx data plane, or possibly redirect traffic from other Ingresses. Kubernetes clusters are only affected if they are using ingress-nginx.\n\nDue to a missing check, the mirror-target Ingress annotation can be used to target an unauthenticated configuration API within the ingress-nginx controller, allowing write commands to be submitted. Corrupting the data within that configuration API results in all traffic through ingress-nginx being dropped until an Ingress configuration change or a controller restart causes the data to be recreated correctly.\n\nIn principle, this write access could also be used to redirect traffic from other Ingresses controlled by the same ingress-nginx instance. In practice, there is negligible additional risk: such redirection would require privileged information about internal ingress-nginx state, and users can already redirect traffic from other Ingresses controlled by the same ingress-nginx anyway."}],"id":"CVE-2026-116472","lastModified":"2026-11-12T19:16:47.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"jordan@liggitt.net","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116472","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T18:58:13.190887Z","version":"2.0.3"}}]},"published":"2026-11-05T19:17:10.690","references":[{"source":"jordan@liggitt.net","url":"https://github.com/kubernetes/kubernetes/issues/143852"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/05/4"}],"sourceIdentifier":"jordan@liggitt.net","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"jordan@liggitt.net","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116500.json b/data/2026/CVE-2026-116500.json index fc4465954b..d835c2b45f 100644 --- a/data/2026/CVE-2026-116500.json +++ b/data/2026/CVE-2026-116500.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:qiskit_sdk:2.4.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:qiskit_sdk:2.6.1:*:*:*:*:*:*:*"],"product":"Qiskit SDK","vendor":"IBM","versions":[{"lessThanOrEqual":"2.6.1","status":"affected","version":"2.4.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads."}],"id":"CVE-2026-116500","lastModified":"2026-11-08T17:16:37.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T17:16:37.007","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295235"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:qiskit_sdk:2.4.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:qiskit_sdk:2.6.1:*:*:*:*:*:*:*"],"product":"Qiskit SDK","vendor":"IBM","versions":[{"lessThanOrEqual":"2.6.1","status":"affected","version":"2.4.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads."}],"id":"CVE-2026-116500","lastModified":"2026-11-12T20:18:16.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:03:20.577933Z","version":"2.0.3"}}]},"published":"2026-11-08T17:16:37.007","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295235"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116645.json b/data/2026/CVE-2026-116645.json index 35485fe56a..cac1ca10b5 100644 --- a/data/2026/CVE-2026-116645.json +++ b/data/2026/CVE-2026-116645.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"LimeSurvey Community Edition","repo":"https://github.com/LimeSurvey/LimeSurvey","vendor":"LimeSurvey","versions":[{"status":"affected","version":"7.8.0"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges."}],"id":"CVE-2026-116645","lastModified":"2026-11-11T03:16:48.630","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-11T03:16:48.630","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/es/advisories/pantera"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/admin/import_helper.php"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/export_helper.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"help@fluidattacks.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"LimeSurvey Community Edition","repo":"https://github.com/LimeSurvey/LimeSurvey","vendor":"LimeSurvey","versions":[{"status":"affected","version":"7.8.0"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges."}],"id":"CVE-2026-116645","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-11T03:16:48.630","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/es/advisories/pantera"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/admin/import_helper.php"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/export_helper.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"help@fluidattacks.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-116835.json b/data/2026/CVE-2026-116835.json index c6f490422d..02a80cd9ea 100644 --- a/data/2026/CVE-2026-116835.json +++ b/data/2026/CVE-2026-116835.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13503","status":"affected","version":"2025.3.11571","versionType":"custom"},{"lessThan":"2026.3.15894","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity."}],"id":"CVE-2026-116835","lastModified":"2026-11-12T14:17:23.630","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-12T14:17:23.630","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-22"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"security@octopus.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13503","status":"affected","version":"2025.3.11571","versionType":"custom"},{"lessThan":"2026.3.15894","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity."}],"id":"CVE-2026-116835","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-12T14:17:23.630","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-22"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"security@octopus.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117477.json b/data/2026/CVE-2026-117477.json index 9c366fe5d4..0d175f3c15 100644 --- a/data/2026/CVE-2026-117477.json +++ b/data/2026/CVE-2026-117477.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"KUSANAGI 7","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 9 Security Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"10.7.2-1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 9 Enterprise Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"10.7.2-1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 8 Free Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 8 Business Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 8 Premium Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 9 Free Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"9.12.2-1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 9 Business Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"9.12.2-1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 9 Premium Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"9.12.2-1","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL."}],"id":"CVE-2026-117477","lastModified":"2026-11-12T06:17:11.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}]},"published":"2026-11-10T00:17:05.140","references":[{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/vu/JVNVU92635551/"},{"source":"vultures@jpcert.or.jp","url":"https://kusanagi.tokyo/en/releases/27995/"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-113"}],"source":"vultures@jpcert.or.jp","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"KUSANAGI 7","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 9 Security Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"10.7.2-1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 9 Enterprise Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"10.7.2-1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 8 Free Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 8 Business Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 8 Premium Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"*","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 9 Free Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"9.12.2-1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 9 Business Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"9.12.2-1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"KUSANAGI 9 Premium Edition","vendor":"GMO Prime Strategy Co., Ltd.","versions":[{"lessThanOrEqual":"9.12.2-1","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL."}],"id":"CVE-2026-117477","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117477","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:06:48.863736Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:05.140","references":[{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/vu/JVNVU92635551/"},{"source":"vultures@jpcert.or.jp","url":"https://kusanagi.tokyo/en/releases/27995/"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-113"}],"source":"vultures@jpcert.or.jp","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117521.json b/data/2026/CVE-2026-117521.json index ce23caffc6..cac5e3d4de 100644 --- a/data/2026/CVE-2026-117521.json +++ b/data/2026/CVE-2026-117521.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Dynific Addons for Elementor (formerly Anywhere Elementor)","vendor":"Unknown","versions":[{"lessThan":"1.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Author role to store a payload that executes in the session of anyone, including an administrator, who views a post the attacker authored, resulting in Stored Cross-Site Scripting."}],"id":"CVE-2026-117521","lastModified":"2026-11-11T12:18:57.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:13.552935Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.240","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/783c1465-9e57-41ca-a6ec-14348d7ee9ad/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Dynific Addons for Elementor (formerly Anywhere Elementor)","vendor":"Unknown","versions":[{"lessThan":"1.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Author role to store a payload that executes in the session of anyone, including an administrator, who views a post the attacker authored, resulting in Stored Cross-Site Scripting."}],"id":"CVE-2026-117521","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:13.552935Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.240","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/783c1465-9e57-41ca-a6ec-14348d7ee9ad/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117522.json b/data/2026/CVE-2026-117522.json index 9a2b7b7b2e..ca861506a0 100644 --- a/data/2026/CVE-2026-117522.json +++ b/data/2026/CVE-2026-117522.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Dynific Addons for Elementor (formerly Anywhere Elementor)","vendor":"Unknown","versions":[{"lessThan":"1.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as script in the session of anyone, including an administrator, who views it, resulting in Stored Cross-Site Scripting."}],"id":"CVE-2026-117522","lastModified":"2026-11-11T12:18:57.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:00.517919Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.390","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/405f11c6-7d5f-48f8-a38c-c8b35870a22d/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Dynific Addons for Elementor (formerly Anywhere Elementor)","vendor":"Unknown","versions":[{"lessThan":"1.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as script in the session of anyone, including an administrator, who views it, resulting in Stored Cross-Site Scripting."}],"id":"CVE-2026-117522","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:25:00.517919Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.390","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/405f11c6-7d5f-48f8-a38c-c8b35870a22d/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117523.json b/data/2026/CVE-2026-117523.json index 75b13ac19f..218b752cc9 100644 --- a/data/2026/CVE-2026-117523.json +++ b/data/2026/CVE-2026-117523.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Dynific Addons for Elementor (formerly Anywhere Elementor)","vendor":"Unknown","versions":[{"lessThan":"1.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide."}],"id":"CVE-2026-117523","lastModified":"2026-11-11T12:18:58.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:24:49.730238Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.513","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/689cf390-e7fa-4202-b418-9ec0066f778a/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Dynific Addons for Elementor (formerly Anywhere Elementor)","vendor":"Unknown","versions":[{"lessThan":"1.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide."}],"id":"CVE-2026-117523","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:24:49.730238Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.513","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/689cf390-e7fa-4202-b418-9ec0066f778a/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117524.json b/data/2026/CVE-2026-117524.json index c978870dc5..caeeec848d 100644 --- a/data/2026/CVE-2026-117524.json +++ b/data/2026/CVE-2026-117524.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Dynific Addons for Elementor (formerly Anywhere Elementor)","vendor":"Unknown","versions":[{"lessThan":"1.3.1","status":"affected","version":"1.3.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors."}],"id":"CVE-2026-117524","lastModified":"2026-11-11T12:18:58.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:24:40.887849Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.647","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/dc064f7f-4be6-4602-a0b2-99c15f8b8fc5/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Dynific Addons for Elementor (formerly Anywhere Elementor)","vendor":"Unknown","versions":[{"lessThan":"1.3.1","status":"affected","version":"1.3.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors."}],"id":"CVE-2026-117524","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:24:40.887849Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.647","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/dc064f7f-4be6-4602-a0b2-99c15f8b8fc5/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117542.json b/data/2026/CVE-2026-117542.json new file mode 100644 index 0000000000..68c6b67144 --- /dev/null +++ b/data/2026/CVE-2026-117542.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations."}],"id":"CVE-2026-117542","lastModified":"2026-11-12T19:16:47.740","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T19:16:47.740","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-35"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-117543.json b/data/2026/CVE-2026-117543.json new file mode 100644 index 0000000000..1de92df3f2 --- /dev/null +++ b/data/2026/CVE-2026-117543.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when retrieving external download URLs could bypass validation of the original destination. This allowed server-side requests to internal or otherwise prohibited destinations and disclosure of their responses (SSRF)."}],"id":"CVE-2026-117543","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:15.503","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-117544.json b/data/2026/CVE-2026-117544.json new file mode 100644 index 0000000000..9c76feb89b --- /dev/null +++ b/data/2026/CVE-2026-117544.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to be delivered to users who were not authorised to access the target download."}],"id":"CVE-2026-117544","lastModified":"2026-11-12T19:16:47.883","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T19:16:47.883","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-117550.json b/data/2026/CVE-2026-117550.json new file mode 100644 index 0000000000..b0184c6f43 --- /dev/null +++ b/data/2026/CVE-2026-117550.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and ownership could be assigned contrary to the intended policy."}],"id":"CVE-2026-117550","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:15.657","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-117551.json b/data/2026/CVE-2026-117551.json new file mode 100644 index 0000000000..c8a1379d4d --- /dev/null +++ b/data/2026/CVE-2026-117551.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution."}],"id":"CVE-2026-117551","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"ATTACKED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:15.813","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-117687.json b/data/2026/CVE-2026-117687.json index 639955e8dd..be17b0b5ad 100644 --- a/data/2026/CVE-2026-117687.json +++ b/data/2026/CVE-2026-117687.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Movable Type","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"8.8.6","status":"affected","version":"8.8.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Movable Type Advanced","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"8.8.6","status":"affected","version":"8.8.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Movable Type","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"8.0.13","status":"affected","version":"8.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Movable Type Advanced","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"8.0.13","status":"affected","version":"8.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Movable Type Premium","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"2.18","status":"affected","version":"2.00","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Movable Type Premium Advanced Edition","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"2.18","status":"affected","version":"2.00","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product."}],"id":"CVE-2026-117687","lastModified":"2026-11-12T04:17:17.783","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}]},"published":"2026-11-12T04:17:17.783","references":[{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/jp/JVN11786640/"},{"source":"vultures@jpcert.or.jp","url":"https://movabletype.org/news/2026/11/mt-887-released.html"},{"source":"vultures@jpcert.or.jp","url":"https://www.sixapart.jp/movabletype/news/2026/11/11-1100.html"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"vultures@jpcert.or.jp","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Movable Type","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"8.8.6","status":"affected","version":"8.8.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Movable Type Advanced","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"8.8.6","status":"affected","version":"8.8.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Movable Type","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"8.0.13","status":"affected","version":"8.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Movable Type Advanced","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"8.0.13","status":"affected","version":"8.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Movable Type Premium","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"2.18","status":"affected","version":"2.00","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Movable Type Premium Advanced Edition","vendor":"Six Apart Ltd.","versions":[{"lessThanOrEqual":"2.18","status":"affected","version":"2.00","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product."}],"id":"CVE-2026-117687","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}]},"published":"2026-11-12T04:17:17.783","references":[{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/jp/JVN11786640/"},{"source":"vultures@jpcert.or.jp","url":"https://movabletype.org/news/2026/11/mt-887-released.html"},{"source":"vultures@jpcert.or.jp","url":"https://www.sixapart.jp/movabletype/news/2026/11/11-1100.html"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"vultures@jpcert.or.jp","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118041.json b/data/2026/CVE-2026-118041.json index 553e3643ca..3d79354d34 100644 --- a/data/2026/CVE-2026-118041.json +++ b/data/2026/CVE-2026-118041.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Contest Gallery","vendor":"Unknown","versions":[{"lessThan":"34.0.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and, by overwriting the directory's protection file through the same flow, achieve Remote Code Execution."}],"id":"CVE-2026-118041","lastModified":"2026-11-11T12:18:58.480","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118041","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:24:26.601788Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.767","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/d202d856-1eb5-47c8-b3cd-571e2073f3bf/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Contest Gallery","vendor":"Unknown","versions":[{"lessThan":"34.0.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and, by overwriting the directory's protection file through the same flow, achieve Remote Code Execution."}],"id":"CVE-2026-118041","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118041","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:24:26.601788Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.767","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/d202d856-1eb5-47c8-b3cd-571e2073f3bf/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118137.json b/data/2026/CVE-2026-118137.json index 37446657e9..c2f4a2b708 100644 --- a/data/2026/CVE-2026-118137.json +++ b/data/2026/CVE-2026-118137.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authorization in Windows FTP Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-118137","lastModified":"2026-11-12T16:18:20.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118137","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:47:50.285573Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:32.120","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118137"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authorization in Windows FTP Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-118137","lastModified":"2026-11-12T20:18:17.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118137","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:47:50.285573Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:32.120","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118137"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118196.json b/data/2026/CVE-2026-118196.json index b340015bff..82c67cddcb 100644 --- a/data/2026/CVE-2026-118196.json +++ b/data/2026/CVE-2026-118196.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Allura","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.22.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OAuth 1 rebinding vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.22.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.1, which fixes the issue."}],"id":"CVE-2026-118196","lastModified":"2026-11-12T16:18:22.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118196","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:23:47.364196Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:21.273","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/2x7c9741d50xw3o10h92rk19cr55trof"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/07/1"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Allura","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.22.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OAuth 1 rebinding vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.22.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.1, which fixes the issue."}],"id":"CVE-2026-118196","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118196","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:23:47.364196Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:21.273","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/2x7c9741d50xw3o10h92rk19cr55trof"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/07/1"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118197.json b/data/2026/CVE-2026-118197.json index 94a25b64cb..5ab1626372 100644 --- a/data/2026/CVE-2026-118197.json +++ b/data/2026/CVE-2026-118197.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-118197","lastModified":"2026-11-10T22:18:23.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:23.113","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-118197","lastModified":"2026-11-12T20:18:17.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118197","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:12:24.770761Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:23.113","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118208.json b/data/2026/CVE-2026-118208.json index 0aeac20728..59af13e84b 100644 --- a/data/2026/CVE-2026-118208.json +++ b/data/2026/CVE-2026-118208.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server Subscription Edition RTM","vendor":"Microsoft","versions":[{"lessThan":"15.02.2562.057","status":"affected","version":"15.02.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network."}],"id":"CVE-2026-118208","lastModified":"2026-11-11T18:19:13.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:44:20.970413Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:37.800","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118208"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server Subscription Edition RTM","vendor":"Microsoft","versions":[{"lessThan":"15.02.2562.057","status":"affected","version":"15.02.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network."}],"id":"CVE-2026-118208","lastModified":"2026-11-12T20:18:17.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:44:20.970413Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:37.800","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118208"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118241.json b/data/2026/CVE-2026-118241.json index ee39422d60..d07709d68e 100644 --- a/data/2026/CVE-2026-118241.json +++ b/data/2026/CVE-2026-118241.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Smush","vendor":"Unknown","versions":[{"lessThan":"4.3.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup."}],"id":"CVE-2026-118241","lastModified":"2026-11-11T12:19:04.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:23:43.428783Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.900","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/150305f1-4cfc-46d2-9b90-b2f84e2e1d7e/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Smush","vendor":"Unknown","versions":[{"lessThan":"4.3.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup."}],"id":"CVE-2026-118241","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:23:43.428783Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:14.900","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/150305f1-4cfc-46d2-9b90-b2f84e2e1d7e/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118368.json b/data/2026/CVE-2026-118368.json index 367f6f1df3..28b57f60f7 100644 --- a/data/2026/CVE-2026-118368.json +++ b/data/2026/CVE-2026-118368.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin."}],"id":"CVE-2026-118368","lastModified":"2026-11-11T05:19:27.373","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-11T05:19:27.373","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/es/advisories/tool"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Imports/Common/Sheets/Items.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/documents/form/line-item.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin."}],"id":"CVE-2026-118368","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-11T05:19:27.373","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/es/advisories/tool"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Imports/Common/Sheets/Items.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/documents/form/line-item.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118391.json b/data/2026/CVE-2026-118391.json index 6b55614df0..f76855db28 100644 --- a/data/2026/CVE-2026-118391.json +++ b/data/2026/CVE-2026-118391.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-ecto:ecto:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"ecto","packageURL":"pkg:hex/ecto","product":"ecto","repo":"https://github.com/elixir-ecto/ecto","vendor":"elixir-ecto","versions":[{"lessThan":"3.14.3","status":"affected","version":"3.4.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-ecto:ecto:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"elixir-ecto/ecto","packageURL":"pkg:github/elixir-ecto/ecto","product":"ecto","repo":"https://github.com/elixir-ecto/ecto","vendor":"elixir-ecto","versions":[{"lessThan":"eef014ad090d27d1a5b69c0e32a50eabd44ab3bb","status":"affected","version":"cb2f03964dac324a9771f84f5088e395326e6de8","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into json_extract_path/2, field[^key] or splice/1. Ecto caches prepared queries per repository in an ETS table with no size limit and no eviction. Interpolated JSON path elements become part of the query expression instead of its parameters, and splice/1 expands into one placeholder per element, so every distinct key or list length creates a new cache entry. With ecto_sql each entry is also a new prepared statement on the database connection that runs it. None of this memory is released until the processes restart.\n\nThis issue affects ecto: from 3.4.0 before 3.14.3."}],"id":"CVE-2026-118391","lastModified":"2026-11-05T19:17:11.763","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118391","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:48:32.374051Z","version":"2.0.3"}}]},"published":"2026-11-04T14:17:29.983","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-118391.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://ecto.hexdocs.pm/Ecto.Query.API.html#json_extract_path/2"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://ecto.hexdocs.pm/Ecto.Query.API.html#splice/1"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/commit/cb2f03964dac324a9771f84f5088e395326e6de8"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/commit/d0e97d8a6e274c81c25fbf08087da8d8b9bae0ea"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/commit/eb03f45b999e2bf67ffae92811233eb6e56dba55"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/commit/eef014ad090d27d1a5b69c0e32a50eabd44ab3bb"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/issues/1031"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/issues/4470"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/security/advisories/GHSA-cxjx-vmm2-qr8r"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-118391"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-ecto:ecto:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"ecto","packageURL":"pkg:hex/ecto","product":"ecto","repo":"https://github.com/elixir-ecto/ecto","vendor":"elixir-ecto","versions":[{"lessThan":"3.14.3","status":"affected","version":"3.4.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-ecto:ecto:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"elixir-ecto/ecto","packageURL":"pkg:github/elixir-ecto/ecto","product":"ecto","repo":"https://github.com/elixir-ecto/ecto","vendor":"elixir-ecto","versions":[{"lessThan":"eef014ad090d27d1a5b69c0e32a50eabd44ab3bb","status":"affected","version":"cb2f03964dac324a9771f84f5088e395326e6de8","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into json_extract_path/2, field[^key] or splice/1. Ecto caches prepared queries per repository in an ETS table with no size limit and no eviction. Interpolated JSON path elements become part of the query expression instead of its parameters, and splice/1 expands into one placeholder per element, so every distinct key or list length creates a new cache entry. With ecto_sql each entry is also a new prepared statement on the database connection that runs it. None of this memory is released until the processes restart.\n\nThis issue affects ecto: from 3.4.0 before 3.14.3."}],"id":"CVE-2026-118391","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118391","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:48:32.374051Z","version":"2.0.3"}}]},"published":"2026-11-04T14:17:29.983","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-118391.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://ecto.hexdocs.pm/Ecto.Query.API.html#json_extract_path/2"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://ecto.hexdocs.pm/Ecto.Query.API.html#splice/1"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/commit/cb2f03964dac324a9771f84f5088e395326e6de8"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/commit/d0e97d8a6e274c81c25fbf08087da8d8b9bae0ea"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/commit/eb03f45b999e2bf67ffae92811233eb6e56dba55"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/commit/eef014ad090d27d1a5b69c0e32a50eabd44ab3bb"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/issues/1031"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/issues/4470"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-ecto/ecto/security/advisories/GHSA-cxjx-vmm2-qr8r"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-118391"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118405.json b/data/2026/CVE-2026-118405.json index 39d468726a..75060a671d 100644 --- a/data/2026/CVE-2026-118405.json +++ b/data/2026/CVE-2026-118405.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user could confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which matches only user names for users who are not administrators."}],"id":"CVE-2026-118405","lastModified":"2026-11-11T13:17:15.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:15.723","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/222"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/9d4nqgq2ox0g88n9gnng8dskshtp3dgo"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user could confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which matches only user names for users who are not administrators."}],"id":"CVE-2026-118405","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:15.723","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/222"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/9d4nqgq2ox0g88n9gnng8dskshtp3dgo"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118408.json b/data/2026/CVE-2026-118408.json index cfe72d7bed..3dd4dff835 100644 --- a/data/2026/CVE-2026-118408.json +++ b/data/2026/CVE-2026-118408.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries."}],"id":"CVE-2026-118408","lastModified":"2026-11-11T13:17:15.863","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:15.863","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/223"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/kzm975k5qhdpwztdmbdfwlfwsd6vopw0"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries."}],"id":"CVE-2026-118408","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:15.863","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/223"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/kzm975k5qhdpwztdmbdfwlfwsd6vopw0"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118409.json b/data/2026/CVE-2026-118409.json index e58417844c..25a7470003 100644 --- a/data/2026/CVE-2026-118409.json +++ b/data/2026/CVE-2026-118409.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index."}],"id":"CVE-2026-118409","lastModified":"2026-11-11T13:17:16.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.023","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/225"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/nf6c1qfdclkf61s3h8p8chf4y7ztjlwd"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index."}],"id":"CVE-2026-118409","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.023","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/225"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/nf6c1qfdclkf61s3h8p8chf4y7ztjlwd"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118410.json b/data/2026/CVE-2026-118410.json index f78791d400..629664eec5 100644 --- a/data/2026/CVE-2026-118410.json +++ b/data/2026/CVE-2026-118410.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results."}],"id":"CVE-2026-118410","lastModified":"2026-11-11T13:17:16.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.177","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/226"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/oy4wv2d7sy9p9kl9nnvvfsjlgsk8bnco"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-668"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results."}],"id":"CVE-2026-118410","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.177","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/226"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/oy4wv2d7sy9p9kl9nnvvfsjlgsk8bnco"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-668"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118411.json b/data/2026/CVE-2026-118411.json index 8ee9701732..6026115049 100644 --- a/data/2026/CVE-2026-118411.json +++ b/data/2026/CVE-2026-118411.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"5.0.1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions also accepted GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST and a valid token for actions that change data."}],"id":"CVE-2026-118411","lastModified":"2026-11-11T13:17:16.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.313","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/227"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/q2h1r9v5qqofxh8qds58dtqrhf85ll60"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"5.0.1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions also accepted GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST and a valid token for actions that change data."}],"id":"CVE-2026-118411","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.313","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/227"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/q2h1r9v5qqofxh8qds58dtqrhf85ll60"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118412.json b/data/2026/CVE-2026-118412.json index b2b1cc47ac..9992b5c37e 100644 --- a/data/2026/CVE-2026-118412.json +++ b/data/2026/CVE-2026-118412.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"5.1.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later."}],"id":"CVE-2026-118412","lastModified":"2026-11-11T13:17:16.460","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.460","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/224"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/lmlcrh06ynr0tfgg2f7vwh3h9gr7b1cs"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"5.1.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only sites that enable the non-default OpenID authentication mode are affected; later major versions do not include OpenID 2.0. Users are recommended to upgrade to Apache Roller 6.1.7 or later."}],"id":"CVE-2026-118412","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.460","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/224"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/lmlcrh06ynr0tfgg2f7vwh3h9gr7b1cs"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118413.json b/data/2026/CVE-2026-118413.json index 7d0df8ff93..fc0edf11e0 100644 --- a/data/2026/CVE-2026-118413.json +++ b/data/2026/CVE-2026-118413.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output."}],"id":"CVE-2026-118413","lastModified":"2026-11-11T13:17:16.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.597","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/221"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/y6cqvqh5sp31kr47347gmv93mj4r0bwf"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's visitors. Blogroll links imported from an OPML file were not checked, and the default theme printed them without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which accepts only web links on import and escapes them on output."}],"id":"CVE-2026-118413","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.597","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/221"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/y6cqvqh5sp31kr47347gmv93mj4r0bwf"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118414.json b/data/2026/CVE-2026-118414.json index 3e64e4d9de..19d4bb3b1f 100644 --- a/data/2026/CVE-2026-118414.json +++ b/data/2026/CVE-2026-118414.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"6.1.2","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later."}],"id":"CVE-2026-118414","lastModified":"2026-11-11T13:17:16.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.740","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/228"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/3grnb7pwlqygxlhpxn4dz4lht4d06v28"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"6.1.2","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later."}],"id":"CVE-2026-118414","lastModified":"2026-11-12T16:59:32.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-11T13:17:16.740","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/228"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/3grnb7pwlqygxlhpxn4dz4lht4d06v28"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118439.json b/data/2026/CVE-2026-118439.json index 3f4e0aae06..9cf81bbb37 100644 --- a/data/2026/CVE-2026-118439.json +++ b/data/2026/CVE-2026-118439.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Limit Login Attempts Security","vendor":"Unknown","versions":[{"lessThan":"3.4.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF)."}],"id":"CVE-2026-118439","lastModified":"2026-11-11T12:19:06.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118439","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:22:52.706014Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:15.387","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/9f7a9969-354c-4b9e-b56f-d832d89741b5/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Limit Login Attempts Security","vendor":"Unknown","versions":[{"lessThan":"3.4.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF)."}],"id":"CVE-2026-118439","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118439","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:22:52.706014Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:15.387","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/9f7a9969-354c-4b9e-b56f-d832d89741b5/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118450.json b/data/2026/CVE-2026-118450.json index 2d60b52c79..b27356e4b1 100644 --- a/data/2026/CVE-2026-118450.json +++ b/data/2026/CVE-2026-118450.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Venere","vendor":"CompuGroup Medical","versions":[{"status":"affected","version":"8.33.2","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files."}],"id":"CVE-2026-118450","lastModified":"2026-11-09T12:16:36.410","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T12:16:36.410","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Venere","vendor":"CompuGroup Medical","versions":[{"status":"affected","version":"8.33.2","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files."}],"id":"CVE-2026-118450","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118450","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:02:32.116675Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:36.410","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118458.json b/data/2026/CVE-2026-118458.json index 7fa1bc562f..b3f2bc7dfe 100644 --- a/data/2026/CVE-2026-118458.json +++ b/data/2026/CVE-2026-118458.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.15.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.15.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts."}],"id":"CVE-2026-118458","lastModified":"2026-11-09T12:16:36.583","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T12:16:36.583","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.15.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.15.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts."}],"id":"CVE-2026-118458","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118458","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:03:22.542759Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:36.583","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118459.json b/data/2026/CVE-2026-118459.json index 7320eb6571..04968acfea 100644 --- a/data/2026/CVE-2026-118459.json +++ b/data/2026/CVE-2026-118459.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials."}],"id":"CVE-2026-118459","lastModified":"2026-11-09T12:16:36.723","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T12:16:36.723","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials."}],"id":"CVE-2026-118459","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118459","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:04:04.158136Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:36.723","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118460.json b/data/2026/CVE-2026-118460.json index dc7955d9b5..2403945eaa 100644 --- a/data/2026/CVE-2026-118460.json +++ b/data/2026/CVE-2026-118460.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.farmaci","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.farmaci","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.farmaci","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.farmaci","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests."}],"id":"CVE-2026-118460","lastModified":"2026-11-09T12:16:36.863","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T12:16:36.863","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.farmaci","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.farmaci","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.farmaci","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.farmaci","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests."}],"id":"CVE-2026-118460","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118460","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:00.394183Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:36.863","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118461.json b/data/2026/CVE-2026-118461.json index 09af562f1a..dba593d9d8 100644 --- a/data/2026/CVE-2026-118461.json +++ b/data/2026/CVE-2026-118461.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.connector","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.10.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.connector","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.10.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.connector","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.10.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.connector","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials."}],"id":"CVE-2026-118461","lastModified":"2026-11-09T12:16:37.000","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T12:16:37.000","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.connector","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.10.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.connector","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.10.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.connector","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.10.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.connector","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials."}],"id":"CVE-2026-118461","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118461","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:06:26.576978Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:37.000","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118462.json b/data/2026/CVE-2026-118462.json index ba477e77ac..3c6a8c4538 100644 --- a/data/2026/CVE-2026-118462.json +++ b/data/2026/CVE-2026-118462.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution."}],"id":"CVE-2026-118462","lastModified":"2026-11-09T12:16:37.130","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T12:16:37.130","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-494"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.files.delivery","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.liveupdates","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"2.12.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution."}],"id":"CVE-2026-118462","lastModified":"2026-11-12T20:18:18.117","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118462","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:58:38.503243Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:37.130","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-494"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118464.json b/data/2026/CVE-2026-118464.json index 5b645057d3..3523dea1ea 100644 --- a/data/2026/CVE-2026-118464.json +++ b/data/2026/CVE-2026-118464.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields."}],"id":"CVE-2026-118464","lastModified":"2026-11-09T12:16:37.270","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T12:16:37.270","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields."}],"id":"CVE-2026-118464","lastModified":"2026-11-12T20:18:18.950","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:01:53.703126Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:37.270","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118465.json b/data/2026/CVE-2026-118465.json index 0c0538cc1a..b40f1898dc 100644 --- a/data/2026/CVE-2026-118465.json +++ b/data/2026/CVE-2026-118465.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations."}],"id":"CVE-2026-118465","lastModified":"2026-11-09T12:16:37.423","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T12:16:37.423","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations."}],"id":"CVE-2026-118465","lastModified":"2026-11-12T20:18:19.180","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118465","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:02:53.587949Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:37.423","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118467.json b/data/2026/CVE-2026-118467.json index 08f4246985..efda25be48 100644 --- a/data/2026/CVE-2026-118467.json +++ b/data/2026/CVE-2026-118467.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"ImxTracing","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"ImxTracing","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"ImxTracing","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"ImxTracing","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection."}],"id":"CVE-2026-118467","lastModified":"2026-11-09T12:16:37.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T12:16:37.563","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageName":"ImxTracing","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"ImxTracing","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"ImxTracing","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"ImxTracing","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"1.3.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unknown","packageName":"cgm.it.ais.common","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection."}],"id":"CVE-2026-118467","lastModified":"2026-11-12T20:18:19.400","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118467","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:03:19.631340Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:37.563","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118468.json b/data/2026/CVE-2026-118468.json index c5c20c1f92..b8b1a087a3 100644 --- a/data/2026/CVE-2026-118468.json +++ b/data/2026/CVE-2026-118468.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.01.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.01.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"4.51.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"8.33.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks."}],"id":"CVE-2026-118468","lastModified":"2026-11-09T12:16:37.710","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T12:16:37.710","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.01.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.01.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Phronesis","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"4.51.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"8.33.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks."}],"id":"CVE-2026-118468","lastModified":"2026-11-12T20:18:19.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:03:46.041621Z","version":"2.0.3"}}]},"published":"2026-11-09T12:16:37.710","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118478.json b/data/2026/CVE-2026-118478.json index bf54cce167..a018be40d1 100644 --- a/data/2026/CVE-2026-118478.json +++ b/data/2026/CVE-2026-118478.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}],"id":"CVE-2026-118478","lastModified":"2026-11-10T22:18:23.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:23.590","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}],"id":"CVE-2026-118478","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:23.590","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118479.json b/data/2026/CVE-2026-118479.json index 07202d8fb6..6325595d87 100644 --- a/data/2026/CVE-2026-118479.json +++ b/data/2026/CVE-2026-118479.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"Forms Hotfix for AEM 6.5 QuickStart - 1.0.12","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-118479","lastModified":"2026-11-10T22:18:23.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:23.717","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"Forms Hotfix for AEM 6.5 QuickStart - 1.0.12","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-118479","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:23.717","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118480.json b/data/2026/CVE-2026-118480.json index c1977ce197..cdcd6ca1e8 100644 --- a/data/2026/CVE-2026-118480.json +++ b/data/2026/CVE-2026-118480.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"Forms Hotfix for AEM 6.5 QuickStart - 1.0.12","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-118480","lastModified":"2026-11-12T15:17:42.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118480","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:07:44.508243Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:23.833","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"Forms Hotfix for AEM 6.5 QuickStart - 1.0.12","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-118480","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118480","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:07:44.508243Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:23.833","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118481.json b/data/2026/CVE-2026-118481.json index 898caf2583..dfcc0a6930 100644 --- a/data/2026/CVE-2026-118481.json +++ b/data/2026/CVE-2026-118481.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"Forms Hotfix for AEM 6.5 QuickStart - 1.0.12","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-118481","lastModified":"2026-11-10T22:18:23.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:23.957","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"Forms Hotfix for AEM 6.5 QuickStart - 1.0.12","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-118481","lastModified":"2026-11-12T18:17:15.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118481","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:48.752788Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:23.957","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118482.json b/data/2026/CVE-2026-118482.json index 854458f925..76fde23dd3 100644 --- a/data/2026/CVE-2026-118482.json +++ b/data/2026/CVE-2026-118482.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited read and write access. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-118482","lastModified":"2026-11-10T22:18:24.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:24.087","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited read and write access. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-118482","lastModified":"2026-11-12T20:18:19.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118482","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:12:53.338808Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.087","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118483.json b/data/2026/CVE-2026-118483.json index b604713f65..dda5abff1f 100644 --- a/data/2026/CVE-2026-118483.json +++ b/data/2026/CVE-2026-118483.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Dimension","vendor":"Adobe","versions":[{"lessThanOrEqual":"v4.1.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"v4.1.10","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dimension is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-118483","lastModified":"2026-11-11T11:17:12.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.5,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118483","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:45.500827Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.213","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/dimension/apsb26-190.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Dimension","vendor":"Adobe","versions":[{"lessThanOrEqual":"v4.1.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"v4.1.10","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dimension is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-118483","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.5,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118483","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:45.500827Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.213","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/dimension/apsb26-190.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118492.json b/data/2026/CVE-2026-118492.json index 0a91b749f3..43265a5e1d 100644 --- a/data/2026/CVE-2026-118492.json +++ b/data/2026/CVE-2026-118492.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Langium","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview."}],"id":"CVE-2026-118492","lastModified":"2026-11-09T16:17:26.627","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-09T16:17:26.627","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/512"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1018"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Langium","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview."}],"id":"CVE-2026-118492","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118492","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:25:53.162104Z","version":"2.0.3"}}]},"published":"2026-11-09T16:17:26.627","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/512"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1018"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/eclipse-langium/langium/security/advisories/GHSA-7c4f-7qwx-hmcv"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"emo@eclipse.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118495.json b/data/2026/CVE-2026-118495.json new file mode 100644 index 0000000000..0c7fc2fa96 --- /dev/null +++ b/data/2026/CVE-2026-118495.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"6.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email address can read that subscriber's record, including the per-subscriber secret key that authorises the subscription management links. Holding that key, the attacker can act as that subscriber on those endpoints, which includes triggering the GDPR data export and the GDPR account deletion where those options are enabled."}],"id":"CVE-2026-118495","lastModified":"2026-11-12T19:16:48.103","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118495","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:04:15.877866Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:16.130","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118531.json b/data/2026/CVE-2026-118531.json index 7156bfcc65..aea588ff96 100644 --- a/data/2026/CVE-2026-118531.json +++ b/data/2026/CVE-2026-118531.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","vendor":"Unknown","versions":[{"lessThan":"8.11.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings."}],"id":"CVE-2026-118531","lastModified":"2026-11-12T12:18:19.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:54.361931Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:11.850","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/04ba942d-59f2-4e35-9d09-877f9bdd3606/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","vendor":"Unknown","versions":[{"lessThan":"8.11.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings."}],"id":"CVE-2026-118531","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:54.361931Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:11.850","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/04ba942d-59f2-4e35-9d09-877f9bdd3606/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118597.json b/data/2026/CVE-2026-118597.json index ca4cb9246b..0f503dbcf9 100644 --- a/data/2026/CVE-2026-118597.json +++ b/data/2026/CVE-2026-118597.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin."}],"id":"CVE-2026-118597","lastModified":"2026-11-12T06:17:11.980","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-12T06:17:11.980","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/rhiannon"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Abstracts/Http/SettingController.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/View/Components/Form/Group/PaymentTerm.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/group/payment_term.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin."}],"id":"CVE-2026-118597","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-12T06:17:11.980","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/rhiannon"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Abstracts/Http/SettingController.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/View/Components/Form/Group/PaymentTerm.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/group/payment_term.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118631.json b/data/2026/CVE-2026-118631.json index e03eff98c5..1ff40069f9 100644 --- a/data/2026/CVE-2026-118631.json +++ b/data/2026/CVE-2026-118631.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Hue Bridge Pro","vendor":"Philips","versions":[{"status":"affected","version":"2071026000"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability.\n\nThe specific flaw exists within the factory data service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to modify files in the context of the service account. Was ZDI-CAN-33090."}],"id":"CVE-2026-118631","lastModified":"2026-11-12T03:17:10.057","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","version":"3.0"},"exploitabilityScore":2.0,"impactScore":1.4,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:10.057","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-890/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Hue Bridge Pro","vendor":"Philips","versions":[{"status":"affected","version":"2071026000"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability.\n\nThe specific flaw exists within the factory data service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to modify files in the context of the service account. Was ZDI-CAN-33090."}],"id":"CVE-2026-118631","lastModified":"2026-11-12T18:48:46.580","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","version":"3.0"},"exploitabilityScore":2.0,"impactScore":1.4,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:10.057","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-890/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118632.json b/data/2026/CVE-2026-118632.json index 948fc67f60..483852aaf3 100644 --- a/data/2026/CVE-2026-118632.json +++ b/data/2026/CVE-2026-118632.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Hue Bridge Pro","vendor":"Philips","versions":[{"status":"affected","version":"2071026000"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-33089."}],"id":"CVE-2026-118632","lastModified":"2026-11-12T03:17:10.190","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:10.190","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-891/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Hue Bridge Pro","vendor":"Philips","versions":[{"status":"affected","version":"2071026000"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-33089."}],"id":"CVE-2026-118632","lastModified":"2026-11-12T18:48:46.580","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:10.190","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-891/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118670.json b/data/2026/CVE-2026-118670.json index ec40ec416a..e7a4af533f 100644 --- a/data/2026/CVE-2026-118670.json +++ b/data/2026/CVE-2026-118670.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Viewers","vendor":"OHIF","versions":[{"status":"affected","version":">= 3.5.0-beta.0, < 3.12.15"},{"status":"affected","version":">= 3.13.0-beta.0, < 3.13.7"},{"status":"affected","version":">= 3.14.0-beta.0, < 3.14.0-beta.19"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19."}],"id":"CVE-2026-118670","lastModified":"2026-11-06T18:17:57.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.3,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118670","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:47:36.194512Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:57.340","references":[{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/commit/db546701bd5f2be9031c835f1de5c40aacd3dc62"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/commit/ef0811c66cdb04ba07ffaba145cf66ce01486899"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/commit/f0dba789a313f40fe7e8a8cbec322a8d8a491d76"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/pull/6228"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/releases/tag/v3.12.15"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/releases/tag/v3.13.7"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/releases/tag/v3.14.0-beta.19"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Viewers","vendor":"OHIF","versions":[{"status":"affected","version":">= 3.5.0-beta.0, < 3.12.15"},{"status":"affected","version":">= 3.13.0-beta.0, < 3.13.7"},{"status":"affected","version":">= 3.14.0-beta.0, < 3.14.0-beta.19"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19."}],"id":"CVE-2026-118670","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.3,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118670","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:47:36.194512Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:57.340","references":[{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/commit/db546701bd5f2be9031c835f1de5c40aacd3dc62"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/commit/ef0811c66cdb04ba07ffaba145cf66ce01486899"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/commit/f0dba789a313f40fe7e8a8cbec322a8d8a491d76"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/pull/6228"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/releases/tag/v3.12.15"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/releases/tag/v3.13.7"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/releases/tag/v3.14.0-beta.19"},{"source":"security-advisories@github.com","url":"https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118785.json b/data/2026/CVE-2026-118785.json index db91973b17..5ef60c957a 100644 --- a/data/2026/CVE-2026-118785.json +++ b/data/2026/CVE-2026-118785.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["trustzone_examples/hello_world_s/veneer_table.c"],"product":"MCUXpresso SDK","vendor":"NXP","versions":[{"lessThan":"26.09.00","status":"affected","version":"0","versionType":"semver"},{"lessThan":"26.06.01-lts","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of non-secure-world input in NSC veneer\nfunctions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples),\naffecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a\nnon-secure caller to supply unvalidated pointers or untrusted data, causing a\ntiming side-channel, TOCTOU condition, or format-string misuse, potentially\nresulting in secure-world memory disclosure or denial of service. All software\nversions starting from 26.06.01-lts and 26.09.00 have fixed this issue."}],"id":"CVE-2026-118785","lastModified":"2026-11-10T15:17:13.677","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.4,"impactScore":5.2,"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118785","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:15:37.684771Z","version":"2.0.3"}}]},"published":"2026-11-06T23:17:20.840","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["trustzone_examples/hello_world_s/veneer_table.c"],"product":"MCUXpresso SDK","vendor":"NXP","versions":[{"lessThan":"26.09.00","status":"affected","version":"0","versionType":"semver"},{"lessThan":"26.06.01-lts","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of non-secure-world input in NSC veneer\nfunctions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples),\naffecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a\nnon-secure caller to supply unvalidated pointers or untrusted data, causing a\ntiming side-channel, TOCTOU condition, or format-string misuse, potentially\nresulting in secure-world memory disclosure or denial of service. All software\nversions starting from 26.06.01-lts and 26.09.00 have fixed this issue."}],"id":"CVE-2026-118785","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.4,"impactScore":5.2,"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118785","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:15:37.684771Z","version":"2.0.3"}}]},"published":"2026-11-06T23:17:20.840","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118786.json b/data/2026/CVE-2026-118786.json index bfcfe8f821..8a6d10bbb9 100644 --- a/data/2026/CVE-2026-118786.json +++ b/data/2026/CVE-2026-118786.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["multicore_examples/rpmsg_lite_pingpong_tzm/veneer_table.c"],"product":"MCUXpresso SDK","vendor":"NXP","versions":[{"lessThan":"26.12.00-pvw1","status":"affected","version":"0","versionType":"semver"},{"lessThan":"26.06.01-lts","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in non-secure-callable (NSC)\nveneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example\n(multicore_examples/rpmsg_lite_pingpong_tzm) up to releases 26.06.00-lts and\n26.09.00 may allow a non-secure caller to supply unvalidated pointers and size\nvalues, potentially resulting in disclosure of secure-world memory to the\nnon-secure domain, or denial of service. All software versions starting from\n26.06.01-lts and 26.12.00-pvw1 have fixed this issue."}],"id":"CVE-2026-118786","lastModified":"2026-11-10T15:17:13.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.5,"impactScore":4.2,"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118786","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:15:00.587704Z","version":"2.0.3"}}]},"published":"2026-11-06T23:17:20.970","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["multicore_examples/rpmsg_lite_pingpong_tzm/veneer_table.c"],"product":"MCUXpresso SDK","vendor":"NXP","versions":[{"lessThan":"26.12.00-pvw1","status":"affected","version":"0","versionType":"semver"},{"lessThan":"26.06.01-lts","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in non-secure-callable (NSC)\nveneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example\n(multicore_examples/rpmsg_lite_pingpong_tzm) up to releases 26.06.00-lts and\n26.09.00 may allow a non-secure caller to supply unvalidated pointers and size\nvalues, potentially resulting in disclosure of secure-world memory to the\nnon-secure domain, or denial of service. All software versions starting from\n26.06.01-lts and 26.12.00-pvw1 have fixed this issue."}],"id":"CVE-2026-118786","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.5,"impactScore":4.2,"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118786","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:15:00.587704Z","version":"2.0.3"}}]},"published":"2026-11-06T23:17:20.970","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://mcuxpresso.nxp.com/mcuxsdk/26.12.00-pvw1/release/index.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118790.json b/data/2026/CVE-2026-118790.json index 84b80466eb..57f5dccdcd 100644 --- a/data/2026/CVE-2026-118790.json +++ b/data/2026/CVE-2026-118790.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wingesfar","vendor":"CompuGroup Medical","versions":[{"lessThan":"2026.07a","status":"affected","version":"0","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments."}],"id":"CVE-2026-118790","lastModified":"2026-11-09T13:17:05.200","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T13:17:05.200","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wingesfar","vendor":"CompuGroup Medical","versions":[{"lessThan":"2026.07a","status":"affected","version":"0","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments."}],"id":"CVE-2026-118790","lastModified":"2026-11-12T20:18:20.117","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118790","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:04:09.765333Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:05.200","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118791.json b/data/2026/CVE-2026-118791.json index 5132fa729e..e25bbc81c9 100644 --- a/data/2026/CVE-2026-118791.json +++ b/data/2026/CVE-2026-118791.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wingesfar","vendor":"CompuGroup Medical","versions":[{"lessThan":"10.2.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification."}],"id":"CVE-2026-118791","lastModified":"2026-11-09T13:17:05.337","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T13:17:05.337","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-494"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wingesfar","vendor":"CompuGroup Medical","versions":[{"lessThan":"10.2.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification."}],"id":"CVE-2026-118791","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118791","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:05:26.447064Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:05.337","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-494"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118792.json b/data/2026/CVE-2026-118792.json index 570e65135c..7457670694 100644 --- a/data/2026/CVE-2026-118792.json +++ b/data/2026/CVE-2026-118792.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wingesfar","vendor":"CompuGroup Medical","versions":[{"lessThan":"2026.07a","status":"affected","version":"0","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Default credentials permit access through AcuXDBC."}],"id":"CVE-2026-118792","lastModified":"2026-11-09T13:17:05.460","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]},"published":"2026-11-09T13:17:05.460","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wingesfar","vendor":"CompuGroup Medical","versions":[{"lessThan":"2026.07a","status":"affected","version":"0","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Default credentials permit access through AcuXDBC."}],"id":"CVE-2026-118792","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118792","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:04:44.361327Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:05.460","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118795.json b/data/2026/CVE-2026-118795.json index 1149b11cfa..ffa8daf666 100644 --- a/data/2026/CVE-2026-118795.json +++ b/data/2026/CVE-2026-118795.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"8.33.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access."}],"id":"CVE-2026-118795","lastModified":"2026-11-09T16:17:26.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118795","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:04:53.696870Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:05.593","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-602"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Infantia","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Profim","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"6.09.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Venere","vendor":"CompuGroup Medical","versions":[{"lessThanOrEqual":"8.33.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access."}],"id":"CVE-2026-118795","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118795","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:04:53.696870Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:05.593","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-602"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118798.json b/data/2026/CVE-2026-118798.json index fac459ccb7..701eb916a7 100644 --- a/data/2026/CVE-2026-118798.json +++ b/data/2026/CVE-2026-118798.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wingesfar","vendor":"CompuGroup Medical","versions":[{"lessThan":"2026.07a","status":"affected","version":"0","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise."}],"id":"CVE-2026-118798","lastModified":"2026-11-09T16:17:26.907","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:04:43.118723Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:05.727","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wingesfar","vendor":"CompuGroup Medical","versions":[{"lessThan":"2026.07a","status":"affected","version":"0","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise."}],"id":"CVE-2026-118798","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:04:43.118723Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:05.727","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118855.json b/data/2026/CVE-2026-118855.json index 584bce19ee..fc866a9e94 100644 --- a/data/2026/CVE-2026-118855.json +++ b/data/2026/CVE-2026-118855.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin."}],"id":"CVE-2026-118855","lastModified":"2026-11-12T08:16:39.930","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-12T08:16:39.930","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/sabbath"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Http/Requests/Document/Document.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/input/hidden.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin."}],"id":"CVE-2026-118855","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-12T08:16:39.930","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/sabbath"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Http/Requests/Document/Document.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/input/hidden.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118952.json b/data/2026/CVE-2026-118952.json index 08099c3978..e2ac1f725a 100644 --- a/data/2026/CVE-2026-118952.json +++ b/data/2026/CVE-2026-118952.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:2"],"defaultStatus":"unaffected","packageName":"kroxylicious-authorizer-acl","product":"streams for Apache Kafka 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3"],"defaultStatus":"affected","packageName":"kroxylicious-authorizer-acl","product":"streams for Apache Kafka 3","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied."}],"id":"CVE-2026-118952","lastModified":"2026-10-30T07:16:33.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-10-30T07:16:33.410","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-118952"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563276"},{"source":"secalert@redhat.com","url":"https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:2"],"defaultStatus":"unaffected","packageName":"kroxylicious-authorizer-acl","product":"streams for Apache Kafka 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3"],"defaultStatus":"affected","packageName":"kroxylicious-authorizer-acl","product":"streams for Apache Kafka 3","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied."}],"id":"CVE-2026-118952","lastModified":"2026-11-12T19:16:48.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118952","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T19:37:48.997920Z","version":"2.0.3"}}]},"published":"2026-10-30T07:16:33.410","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-118952"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563276"},{"source":"secalert@redhat.com","url":"https://github.com/kroxylicious/kroxylicious/security/advisories/GHSA-qvv3-6w3q-hgqc"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118975.json b/data/2026/CVE-2026-118975.json index 9667944e8d..ff7047b2d8 100644 --- a/data/2026/CVE-2026-118975.json +++ b/data/2026/CVE-2026-118975.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik Reporting","vendor":"Progress Software","versions":[{"lessThan":"20.3.26.1110","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network requests, from the report rendering host. External XML entities in SVG content were resolved without applying the configured strict resource resolver and report path validation. Disclosed content is limited by the permissions of the rendering process and by what the rendered report output exposes."}],"id":"CVE-2026-118975","lastModified":"2026-11-12T10:17:28.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T10:17:28.230","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/reporting/documentation/knowledge-base/kb-security-improper-restriction-of-xml-external-entity-reference-cve-2026-118975"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik Reporting","vendor":"Progress Software","versions":[{"lessThan":"20.3.26.1110","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network requests, from the report rendering host. External XML entities in SVG content were resolved without applying the configured strict resource resolver and report path validation. Disclosed content is limited by the permissions of the rendering process and by what the rendered report output exposes."}],"id":"CVE-2026-118975","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T10:17:28.230","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/reporting/documentation/knowledge-base/kb-security-improper-restriction-of-xml-external-entity-reference-cve-2026-118975"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-119017.json b/data/2026/CVE-2026-119017.json index 6f12e273bf..89573f7d5f 100644 --- a/data/2026/CVE-2026-119017.json +++ b/data/2026/CVE-2026-119017.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-119017","lastModified":"2026-11-11T11:17:13.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119017","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:50.614112Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.520","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5.25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-119017","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119017","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:50.614112Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.520","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119032.json b/data/2026/CVE-2026-119032.json index 824bb0ecaf..5b8e0e647c 100644 --- a/data/2026/CVE-2026-119032.json +++ b/data/2026/CVE-2026-119032.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Schema & Structured Data for WP & AMP","vendor":"Unknown","versions":[{"lessThan":"1.70","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta."}],"id":"CVE-2026-119032","lastModified":"2026-11-11T12:19:10.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119032","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:22:39.205498Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:15.517","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e8a5285d-5d03-4b50-8028-6c71d02e1c18/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Schema & Structured Data for WP & AMP","vendor":"Unknown","versions":[{"lessThan":"1.70","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta."}],"id":"CVE-2026-119032","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119032","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:22:39.205498Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:15.517","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e8a5285d-5d03-4b50-8028-6c71d02e1c18/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119033.json b/data/2026/CVE-2026-119033.json index 4a6185bc5d..5ecaa7945c 100644 --- a/data/2026/CVE-2026-119033.json +++ b/data/2026/CVE-2026-119033.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Schema & Structured Data for WP & AMP","vendor":"Unknown","versions":[{"lessThan":"1.70","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own."}],"id":"CVE-2026-119033","lastModified":"2026-11-11T12:19:11.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.2,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119033","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:22:18.085650Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:15.643","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/0156d20c-90a0-4567-bee4-cbab31bf4c71/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Schema & Structured Data for WP & AMP","vendor":"Unknown","versions":[{"lessThan":"1.70","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own."}],"id":"CVE-2026-119033","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.2,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119033","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:22:18.085650Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:15.643","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/0156d20c-90a0-4567-bee4-cbab31bf4c71/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119034.json b/data/2026/CVE-2026-119034.json index 0d34c82f56..a21e1a9800 100644 --- a/data/2026/CVE-2026-119034.json +++ b/data/2026/CVE-2026-119034.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Schema & Structured Data for WP & AMP","vendor":"Unknown","versions":[{"lessThan":"1.70","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide."}],"id":"CVE-2026-119034","lastModified":"2026-11-11T12:19:11.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119034","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:22:07.826179Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:15.760","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/fc30c9de-6c32-4235-abef-625ebf4cc1b0/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Schema & Structured Data for WP & AMP","vendor":"Unknown","versions":[{"lessThan":"1.70","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide."}],"id":"CVE-2026-119034","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119034","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:22:07.826179Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:15.760","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/fc30c9de-6c32-4235-abef-625ebf4cc1b0/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119035.json b/data/2026/CVE-2026-119035.json index 4171f22b5b..ad509244ed 100644 --- a/data/2026/CVE-2026-119035.json +++ b/data/2026/CVE-2026-119035.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Schema & Structured Data for WP & AMP","vendor":"Unknown","versions":[{"lessThan":"1.70","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field."}],"id":"CVE-2026-119035","lastModified":"2026-11-11T12:19:11.480","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119035","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:21:57.856499Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:15.917","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/f8fb358e-e0aa-4a4d-a4d0-b6f383b115a2/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Schema & Structured Data for WP & AMP","vendor":"Unknown","versions":[{"lessThan":"1.70","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field."}],"id":"CVE-2026-119035","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119035","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:21:57.856499Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:15.917","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/f8fb358e-e0aa-4a4d-a4d0-b6f383b115a2/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119039.json b/data/2026/CVE-2026-119039.json index d38057e202..0ecf18d650 100644 --- a/data/2026/CVE-2026-119039.json +++ b/data/2026/CVE-2026-119039.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Defender Security","vendor":"Unknown","versions":[{"lessThan":"6.4.1","status":"affected","version":"4.9.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs."}],"id":"CVE-2026-119039","lastModified":"2026-11-12T12:18:19.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119039","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:41.340931Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:12.143","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/58a8fb54-7dc6-4749-9467-6ce19a13f0ed/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Defender Security","vendor":"Unknown","versions":[{"lessThan":"6.4.1","status":"affected","version":"4.9.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall and lockout decisions actually originates from a trusted source, trusting a user-supplied value by default, allowing unauthenticated attackers to spoof their IP address and evade IP-based protections such as login lockout and IP banning, impersonate an allowlisted address, and poison the Defender Security WordPress plugin before 6.4.1's activity logs."}],"id":"CVE-2026-119039","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119039","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:41.340931Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:12.143","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/58a8fb54-7dc6-4749-9467-6ce19a13f0ed/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119040.json b/data/2026/CVE-2026-119040.json index 3ed8053427..ed4a264b2a 100644 --- a/data/2026/CVE-2026-119040.json +++ b/data/2026/CVE-2026-119040.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Defender Security","vendor":"Unknown","versions":[{"lessThan":"6.4.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor."}],"id":"CVE-2026-119040","lastModified":"2026-11-12T12:18:19.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119040","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:32.780839Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:12.257","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/325f30c7-7ea9-48c8-a7fc-2644779e6ca6/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Defender Security","vendor":"Unknown","versions":[{"lessThan":"6.4.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts in its default configuration, allowing an attacker who already knows a victim's password to brute-force the one-time code and defeat the second authentication factor."}],"id":"CVE-2026-119040","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119040","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:32.780839Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:12.257","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/325f30c7-7ea9-48c8-a7fc-2644779e6ca6/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119078.json b/data/2026/CVE-2026-119078.json index f310572494..025fc23f27 100644 --- a/data/2026/CVE-2026-119078.json +++ b/data/2026/CVE-2026-119078.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"commons-codec:commons-codec","packageURL":"pkg:maven/commons-codec/commons-codec","product":"Apache Commons Codec","vendor":"Apache Software Foundation","versions":[{"lessThan":"1.23.0","status":"affected","version":"1.16.0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again without supplying more input returns the same bytes. The key-derivation example in the class Javadoc, shipped since 1.16.0, derives two keys with two consecutive doFinalize calls. Code that follows it gets identical keys, so the separation between the derived keys is lost. The same applies to any application that calls doFinalize more than once on one instance and expects new output each time.\n\n\n\nThis issue affects Apache Commons Codec from 1.16.0 before 1.23.0.\n\n\n\nVersion 1.23.0 corrects the documentation, but the behavior of doFinalize is unchanged. Upgrading alone does not fix affected code. Users should check their applications for repeated doFinalize calls on the same Blake3 instance and derive multiple keys by requesting the combined length in one call and splitting the output, as the updated Javadoc shows."}],"id":"CVE-2026-119078","lastModified":"2026-11-10T01:17:15.863","metrics":{},"published":"2026-11-09T20:18:04.697","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/ol71kdgopfxwlxgqmkd0jrfcw05wdq5z"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/29"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-684"},{"lang":"en","value":"CWE-1068"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"commons-codec:commons-codec","packageURL":"pkg:maven/commons-codec/commons-codec","product":"Apache Commons Codec","vendor":"Apache Software Foundation","versions":[{"lessThan":"1.23.0","status":"affected","version":"1.16.0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again without supplying more input returns the same bytes. The key-derivation example in the class Javadoc, shipped since 1.16.0, derives two keys with two consecutive doFinalize calls. Code that follows it gets identical keys, so the separation between the derived keys is lost. The same applies to any application that calls doFinalize more than once on one instance and expects new output each time.\n\n\n\nThis issue affects Apache Commons Codec from 1.16.0 before 1.23.0.\n\n\n\nVersion 1.23.0 corrects the documentation, but the behavior of doFinalize is unchanged. Upgrading alone does not fix affected code. Users should check their applications for repeated doFinalize calls on the same Blake3 instance and derive multiple keys by requesting the combined length in one call and splitting the output, as the updated Javadoc shows."}],"id":"CVE-2026-119078","lastModified":"2026-11-12T18:17:16.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119078","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:34:39.759113Z","version":"2.0.3"}}]},"published":"2026-11-09T20:18:04.697","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/ol71kdgopfxwlxgqmkd0jrfcw05wdq5z"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/29"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-684"},{"lang":"en","value":"CWE-1068"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119079.json b/data/2026/CVE-2026-119079.json index 1ffc79b57a..43842ea93a 100644 --- a/data/2026/CVE-2026-119079.json +++ b/data/2026/CVE-2026-119079.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}],"id":"CVE-2026-119079","lastModified":"2026-11-12T13:17:11.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:43.023","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-119079"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479231"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-408"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}],"id":"CVE-2026-119079","lastModified":"2026-11-12T17:17:26.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:43.023","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-119079"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479231"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-408"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119083.json b/data/2026/CVE-2026-119083.json index 5eec31134a..4953724d10 100644 --- a/data/2026/CVE-2026-119083.json +++ b/data/2026/CVE-2026-119083.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"gluonts","vendor":"AWS","versions":[{"lessThan":"0.17.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive.\n\n\n\nTo remediate this issue, users should upgrade to version 0.17.0 or later."}],"id":"CVE-2026-119083","lastModified":"2026-11-05T19:17:14.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119083","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T17:09:22.286678Z","version":"2.0.3"}}]},"published":"2026-11-05T17:17:55.840","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-171-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/awslabs/gluonts/releases/tag/v0.17.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/awslabs/gluonts/security/advisories/GHSA-rg2m-55pr-vp3q"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"gluonts","vendor":"AWS","versions":[{"lessThan":"0.17.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive.\n\n\n\nTo remediate this issue, users should upgrade to version 0.17.0 or later."}],"id":"CVE-2026-119083","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119083","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T17:09:22.286678Z","version":"2.0.3"}}]},"published":"2026-11-05T17:17:55.840","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-171-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/awslabs/gluonts/releases/tag/v0.17.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/awslabs/gluonts/security/advisories/GHSA-rg2m-55pr-vp3q"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119171.json b/data/2026/CVE-2026-119171.json index 1630472a97..1aad87a6c6 100644 --- a/data/2026/CVE-2026-119171.json +++ b/data/2026/CVE-2026-119171.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"Advanced Product Fields (Product Addons) for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"1.7.4","status":"affected","version":"1.6.22","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price."}],"id":"CVE-2026-119171","lastModified":"2026-11-11T12:19:11.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119171","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:13:23.058141Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:17.297","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e02cc0f2-9f10-4114-b9b5-1e1a2ae18355/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"Advanced Product Fields (Product Addons) for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"1.7.4","status":"affected","version":"1.6.22","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price."}],"id":"CVE-2026-119171","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119171","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:13:23.058141Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:17.297","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e02cc0f2-9f10-4114-b9b5-1e1a2ae18355/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119234.json b/data/2026/CVE-2026-119234.json index ba8683b6ff..c483b765c0 100644 --- a/data/2026/CVE-2026-119234.json +++ b/data/2026/CVE-2026-119234.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mvfst","vendor":"Facebook","versions":[{"lessThan":"v2026.11.09.0","status":"affected","version":"v0.0.0.0","versionType":"semver"}]}],"source":"cve-assign@fb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment memory and bookkeeping. A remote, unauthenticated QUIC peer could send many small, non-contiguous stream fragments to make an endpoint consume memory far in excess of its advertised receive window and spend increasing CPU time reassembling stream data, leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.0."}],"id":"CVE-2026-119234","lastModified":"2026-11-11T17:17:16.543","metrics":{},"published":"2026-11-11T17:17:16.543","references":[{"source":"cve-assign@fb.com","url":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"source":"cve-assign@fb.com","url":"https://www.facebook.com/security/advisories/cve-2026-119234"}],"sourceIdentifier":"cve-assign@fb.com","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mvfst","vendor":"Facebook","versions":[{"lessThan":"v2026.11.09.0","status":"affected","version":"v0.0.0.0","versionType":"semver"}]}],"source":"cve-assign@fb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC flow control limits the number of buffered stream bytes, but not this per-fragment memory and bookkeeping. A remote, unauthenticated QUIC peer could send many small, non-contiguous stream fragments to make an endpoint consume memory far in excess of its advertised receive window and spend increasing CPU time reassembling stream data, leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.0."}],"id":"CVE-2026-119234","lastModified":"2026-11-12T20:04:52.377","metrics":{},"published":"2026-11-11T17:17:16.543","references":[{"source":"cve-assign@fb.com","url":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"source":"cve-assign@fb.com","url":"https://www.facebook.com/security/advisories/cve-2026-119234"}],"sourceIdentifier":"cve-assign@fb.com","vulnStatus":"Awaiting Analysis"} diff --git a/data/2026/CVE-2026-119236.json b/data/2026/CVE-2026-119236.json index 5401729324..74ba96da35 100644 --- a/data/2026/CVE-2026-119236.json +++ b/data/2026/CVE-2026-119236.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mvfst","vendor":"Facebook","versions":[{"lessThan":"v2026.11.09.00","status":"affected","version":"v0.0.0.0","versionType":"semver"}]}],"source":"cve-assign@fb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO stream buffer limit. A remote, unauthenticated client could complete a handshake, withhold its acknowledgment of the server's HANDSHAKE_DONE frame so that Handshake keys stay in use, and keep sending Handshake-level CRYPTO data at increasing offsets, causing unbounded memory growth on the server and leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.00."}],"id":"CVE-2026-119236","lastModified":"2026-11-11T17:17:16.800","metrics":{},"published":"2026-11-11T17:17:16.800","references":[{"source":"cve-assign@fb.com","url":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"source":"cve-assign@fb.com","url":"https://www.facebook.com/security/advisories/cve-2026-119236"}],"sourceIdentifier":"cve-assign@fb.com","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mvfst","vendor":"Facebook","versions":[{"lessThan":"v2026.11.09.00","status":"affected","version":"v0.0.0.0","versionType":"semver"}]}],"source":"cve-assign@fb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because the transport treated this data as delivered, it did not count against the CRYPTO stream buffer limit. A remote, unauthenticated client could complete a handshake, withhold its acknowledgment of the server's HANDSHAKE_DONE frame so that Handshake keys stay in use, and keep sending Handshake-level CRYPTO data at increasing offsets, causing unbounded memory growth on the server and leading to denial of service. This issue affects mvfst versions prior to v2026.11.09.00."}],"id":"CVE-2026-119236","lastModified":"2026-11-12T20:04:52.377","metrics":{},"published":"2026-11-11T17:17:16.800","references":[{"source":"cve-assign@fb.com","url":"https://github.com/meta/mvfst/commit/7e5cff58e8cbed87793141ceeca0a8a343c67c44"},{"source":"cve-assign@fb.com","url":"https://www.facebook.com/security/advisories/cve-2026-119236"}],"sourceIdentifier":"cve-assign@fb.com","vulnStatus":"Awaiting Analysis"} diff --git a/data/2026/CVE-2026-119274.json b/data/2026/CVE-2026-119274.json index c73a1db5d8..702d984dab 100644 --- a/data/2026/CVE-2026-119274.json +++ b/data/2026/CVE-2026-119274.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"NIOS","vendor":"Infoblox","versions":[{"lessThan":"9.1.0","status":"affected","version":"9.0.x","versionType":"custom"}]}],"source":"f84ca5ce-fbe7-4668-8724-994599108a02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS"}],"id":"CVE-2026-119274","lastModified":"2026-11-09T15:17:06.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"f84ca5ce-fbe7-4668-8724-994599108a02","type":"Secondary"}]},"published":"2026-11-09T14:17:06.400","references":[{"source":"f84ca5ce-fbe7-4668-8724-994599108a02","url":"https://infoblox.com/"}],"sourceIdentifier":"f84ca5ce-fbe7-4668-8724-994599108a02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"f84ca5ce-fbe7-4668-8724-994599108a02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"NIOS","vendor":"Infoblox","versions":[{"lessThan":"9.1.0","status":"affected","version":"9.0.x","versionType":"custom"}]}],"source":"f84ca5ce-fbe7-4668-8724-994599108a02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS"}],"id":"CVE-2026-119274","lastModified":"2026-11-12T17:17:27.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"f84ca5ce-fbe7-4668-8724-994599108a02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119274","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:18:37.808188Z","version":"2.0.3"}}]},"published":"2026-11-09T14:17:06.400","references":[{"source":"f84ca5ce-fbe7-4668-8724-994599108a02","url":"https://infoblox.com/"}],"sourceIdentifier":"f84ca5ce-fbe7-4668-8724-994599108a02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"f84ca5ce-fbe7-4668-8724-994599108a02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119275.json b/data/2026/CVE-2026-119275.json new file mode 100644 index 0000000000..b75d815c64 --- /dev/null +++ b/data/2026/CVE-2026-119275.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflow. An authenticated Manager can import a child invoice whose invoice number contains HTML and is linked to a recurring invoice. When a victim opens that recurring invoice, Akaunting raw-renders the stored child number in an anchor, causing attacker-controlled markup to execute in the victim's browser."}],"id":"CVE-2026-119275","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-12T18:17:16.507","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/soda"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Imports/Sales/Invoices/Sheets/Invoices.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/documents/show/children.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-119302.json b/data/2026/CVE-2026-119302.json index 270d9e9563..b287e0c59a 100644 --- a/data/2026/CVE-2026-119302.json +++ b/data/2026/CVE-2026-119302.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"NotificationX","vendor":"Unknown","versions":[{"lessThan":"3.3.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request."}],"id":"CVE-2026-119302","lastModified":"2026-11-11T12:19:12.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119302","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:12:58.771731Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:17.430","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e0264d07-668c-46f7-acab-0a7b59edb45f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"NotificationX","vendor":"Unknown","versions":[{"lessThan":"3.3.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notification preview path, allowing unauthenticated users to disclose the content of private, draft, pending and password-protected posts and to execute arbitrary registered shortcodes by supplying crafted preview data on any front-end request."}],"id":"CVE-2026-119302","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119302","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:12:58.771731Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:17.430","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e0264d07-668c-46f7-acab-0a7b59edb45f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119303.json b/data/2026/CVE-2026-119303.json index 2eb19c1fea..6fcbea870c 100644 --- a/data/2026/CVE-2026-119303.json +++ b/data/2026/CVE-2026-119303.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"NotificationX","vendor":"Unknown","versions":[{"lessThan":"3.3.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server."}],"id":"CVE-2026-119303","lastModified":"2026-11-11T12:19:12.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119303","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:21:47.291756Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.060","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/0280952e-f388-44a3-a891-5855580a5f5b/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"NotificationX","vendor":"Unknown","versions":[{"lessThan":"3.3.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server."}],"id":"CVE-2026-119303","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119303","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:21:47.291756Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.060","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/0280952e-f388-44a3-a891-5855580a5f5b/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119431.json b/data/2026/CVE-2026-119431.json index 7497d5a02f..d646c95e5d 100644 --- a/data/2026/CVE-2026-119431.json +++ b/data/2026/CVE-2026-119431.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Foxit Workspace","vendor":"Foxit Software Inc.","versions":[{"status":"affected","version":"before 2026-11-6"}]}],"source":"14984358-7092-470d-8f34-ade47a7658a2"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A server-side request forgery (SSRF) vulnerability exists in Foxit Workspace's file-upload functionality. Insufficient validation of user-supplied links may allow a remote attacker to induce the server to access internal resources and return their contents, potentially resulting in sensitive information disclosure and unauthorized access to internal services."}],"id":"CVE-2026-119431","lastModified":"2026-11-10T14:17:13.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119431","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:58:03.396925Z","version":"2.0.3"}}]},"published":"2026-11-06T05:18:20.677","references":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","url":"https://www.foxit.com/support/security-bulletins.html"}],"sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Foxit Workspace","vendor":"Foxit Software Inc.","versions":[{"status":"affected","version":"before 2026-11-6"}]}],"source":"14984358-7092-470d-8f34-ade47a7658a2"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A server-side request forgery (SSRF) vulnerability exists in Foxit Workspace's file-upload functionality. Insufficient validation of user-supplied links may allow a remote attacker to induce the server to access internal resources and return their contents, potentially resulting in sensitive information disclosure and unauthorized access to internal services."}],"id":"CVE-2026-119431","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119431","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:58:03.396925Z","version":"2.0.3"}}]},"published":"2026-11-06T05:18:20.677","references":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","url":"https://www.foxit.com/support/security-bulletins.html"}],"sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119432.json b/data/2026/CVE-2026-119432.json index 718f27ac48..8cd633dcf2 100644 --- a/data/2026/CVE-2026-119432.json +++ b/data/2026/CVE-2026-119432.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Foxit Workspace","vendor":"Foxit Software Inc.","versions":[{"status":"affected","version":"before 2026-11-6"}]}],"source":"14984358-7092-470d-8f34-ade47a7658a2"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially accessing locally stored credentials and enabling credential theft."}],"id":"CVE-2026-119432","lastModified":"2026-11-10T14:17:14.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119432","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:57:24.551733Z","version":"2.0.3"}}]},"published":"2026-11-06T05:18:20.830","references":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","url":"https://www.foxit.com/support/security-bulletins.html"}],"sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Foxit Workspace","vendor":"Foxit Software Inc.","versions":[{"status":"affected","version":"before 2026-11-6"}]}],"source":"14984358-7092-470d-8f34-ade47a7658a2"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting (XSS) vulnerability exists in the Foxit Workspace's file share preview functionality. An attacker could upload a crafted file and share it with a victim. When the victim opens or previews the file, the embedded script executes in the application's origin, potentially accessing locally stored credentials and enabling credential theft."}],"id":"CVE-2026-119432","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119432","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:57:24.551733Z","version":"2.0.3"}}]},"published":"2026-11-06T05:18:20.830","references":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","url":"https://www.foxit.com/support/security-bulletins.html"}],"sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119433.json b/data/2026/CVE-2026-119433.json index 24bdca596f..d1508cd34f 100644 --- a/data/2026/CVE-2026-119433.json +++ b/data/2026/CVE-2026-119433.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Foxit Workspace","vendor":"Foxit Software Inc.","versions":[{"status":"affected","version":"before 2026-11-6"}]}],"source":"14984358-7092-470d-8f34-ade47a7658a2"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external resources, potentially enabling unauthorized access to internal services, network reconnaissance, and sensitive information disclosure."}],"id":"CVE-2026-119433","lastModified":"2026-11-10T14:17:14.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119433","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:58:32.614622Z","version":"2.0.3"}}]},"published":"2026-11-06T05:18:20.970","references":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","url":"https://www.foxit.com/support/security-bulletins.html"}],"sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Foxit Workspace","vendor":"Foxit Software Inc.","versions":[{"status":"affected","version":"before 2026-11-6"}]}],"source":"14984358-7092-470d-8f34-ade47a7658a2"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external resources, potentially enabling unauthorized access to internal services, network reconnaissance, and sensitive information disclosure."}],"id":"CVE-2026-119433","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119433","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:58:32.614622Z","version":"2.0.3"}}]},"published":"2026-11-06T05:18:20.970","references":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","url":"https://www.foxit.com/support/security-bulletins.html"}],"sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119434.json b/data/2026/CVE-2026-119434.json index f03d11a9e9..0bb8c2c15f 100644 --- a/data/2026/CVE-2026-119434.json +++ b/data/2026/CVE-2026-119434.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:silviucpp:ezstd:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["ezstd_nif","ezstd"],"packageName":"ezstd","packageURL":"pkg:hex/ezstd","product":"ezstd","programFiles":["c_src/ezstd_nif.cc","src/ezstd_nif.erl","src/ezstd.erl"],"programRoutines":[{"name":"zstd_nif_decompress_using_ddict"},{"name":"ezstd_nif:decompress_using_ddict/2"},{"name":"ezstd:decompress_using_ddict/2"}],"repo":"https://github.com/silviucpp/ezstd","vendor":"silviucpp","versions":[{"lessThan":"1.2.5","status":"affected","version":"1.0.5","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:silviucpp:ezstd:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["ezstd_nif","ezstd"],"packageName":"silviucpp/ezstd","packageURL":"pkg:github/silviucpp/ezstd","product":"ezstd","programFiles":["c_src/ezstd_nif.cc","src/ezstd_nif.erl","src/ezstd.erl"],"programRoutines":[{"name":"zstd_nif_decompress_using_ddict"},{"name":"ezstd_nif:decompress_using_ddict/2"},{"name":"ezstd:decompress_using_ddict/2"}],"repo":"https://github.com/silviucpp/ezstd","vendor":"silviucpp","versions":[{"lessThan":"e34f4a4f6dc18d990d1cece2d5fceef8e934a195","status":"affected","version":"6730128b1d35eca02a2028671421471ff651f423","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size.\n\nzstd_nif_decompress_using_ddict in c_src/ezstd_nif.cc reads the frame's declared content size with ZSTD_getFrameContentSize and passes it directly to enif_make_new_binary, without the 1 GiB MAX_BUFFER_SIZE check that ezstd:decompress/1 applies before allocating. A valid 65,550-byte frame of RLE blocks declaring 2 GiB is rejected by ezstd:decompress/1 but is fully allocated and decompressed by the dictionary path. The allocation happens inside a NIF, so when it exceeds the memory available to the VM the operating system kills the whole node rather than the calling process.\n\nThis issue affects ezstd: from 1.0.5 before 1.2.5."}],"id":"CVE-2026-119434","lastModified":"2026-11-05T21:18:41.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119434","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:45:27.204341Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:41.210","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-119434.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/silviucpp/ezstd/commit/6730128b1d35eca02a2028671421471ff651f423"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/silviucpp/ezstd/commit/e34f4a4f6dc18d990d1cece2d5fceef8e934a195"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/silviucpp/ezstd/releases/tag/v1.2.5"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-119434"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:silviucpp:ezstd:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["ezstd_nif","ezstd"],"packageName":"ezstd","packageURL":"pkg:hex/ezstd","product":"ezstd","programFiles":["c_src/ezstd_nif.cc","src/ezstd_nif.erl","src/ezstd.erl"],"programRoutines":[{"name":"zstd_nif_decompress_using_ddict"},{"name":"ezstd_nif:decompress_using_ddict/2"},{"name":"ezstd:decompress_using_ddict/2"}],"repo":"https://github.com/silviucpp/ezstd","vendor":"silviucpp","versions":[{"lessThan":"1.2.5","status":"affected","version":"1.0.5","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:silviucpp:ezstd:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["ezstd_nif","ezstd"],"packageName":"silviucpp/ezstd","packageURL":"pkg:github/silviucpp/ezstd","product":"ezstd","programFiles":["c_src/ezstd_nif.cc","src/ezstd_nif.erl","src/ezstd.erl"],"programRoutines":[{"name":"zstd_nif_decompress_using_ddict"},{"name":"ezstd_nif:decompress_using_ddict/2"},{"name":"ezstd:decompress_using_ddict/2"}],"repo":"https://github.com/silviucpp/ezstd","vendor":"silviucpp","versions":[{"lessThan":"e34f4a4f6dc18d990d1cece2d5fceef8e934a195","status":"affected","version":"6730128b1d35eca02a2028671421471ff651f423","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size.\n\nzstd_nif_decompress_using_ddict in c_src/ezstd_nif.cc reads the frame's declared content size with ZSTD_getFrameContentSize and passes it directly to enif_make_new_binary, without the 1 GiB MAX_BUFFER_SIZE check that ezstd:decompress/1 applies before allocating. A valid 65,550-byte frame of RLE blocks declaring 2 GiB is rejected by ezstd:decompress/1 but is fully allocated and decompressed by the dictionary path. The allocation happens inside a NIF, so when it exceeds the memory available to the VM the operating system kills the whole node rather than the calling process.\n\nThis issue affects ezstd: from 1.0.5 before 1.2.5."}],"id":"CVE-2026-119434","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119434","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:45:27.204341Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:41.210","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-119434.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/silviucpp/ezstd/commit/6730128b1d35eca02a2028671421471ff651f423"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/silviucpp/ezstd/commit/e34f4a4f6dc18d990d1cece2d5fceef8e934a195"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/silviucpp/ezstd/releases/tag/v1.2.5"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-119434"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119446.json b/data/2026/CVE-2026-119446.json index 9b5535ecf5..ae44b3aacf 100644 --- a/data/2026/CVE-2026-119446.json +++ b/data/2026/CVE-2026-119446.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHub.Accounts'","'Elixir.NervesHubWeb.Router'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub/accounts.ex","lib/nerves_hub_web/router.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.UserController':cli_session/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':check_cli_session/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli_confirm/2"},{"name":"'Elixir.NervesHub.Accounts':generate_cli_session_token/1"},{"name":"'Elixir.NervesHub.Accounts':cli_session_waiting?/2"},{"name":"'Elixir.NervesHub.Accounts':verify_cli_session_token/2"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"2.5.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHub.Accounts'","'Elixir.NervesHubWeb.Router'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub/accounts.ex","lib/nerves_hub_web/router.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.UserController':cli_session/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':check_cli_session/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli_confirm/2"},{"name":"'Elixir.NervesHub.Accounts':generate_cli_session_token/1"},{"name":"'Elixir.NervesHub.Accounts':cli_session_waiting?/2"},{"name":"'Elixir.NervesHub.Accounts':verify_cli_session_token/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"2.5.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHub.Accounts'","'Elixir.NervesHubWeb.Router'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub/accounts.ex","lib/nerves_hub_web/router.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.UserController':cli_session/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':check_cli_session/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli_confirm/2"},{"name":"'Elixir.NervesHub.Accounts':generate_cli_session_token/1"},{"name":"'Elixir.NervesHub.Accounts':cli_session_waiting?/2"},{"name":"'Elixir.NervesHub.Accounts':verify_cli_session_token/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"3131f1701194b581ab4b3e5e9d81194fc9c83508","status":"affected","version":"e6bf11a812d7aa8b69d854ba8ef02d65516f5564","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user's account and stores it on the login, and the next poll of GET /api/auth/cli_session/ returns it to whoever started the login.\n\nThe confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves.\n\nThis issue affects nerves_hub: from 2.5.0 before 2.5.3."}],"id":"CVE-2026-119446","lastModified":"2026-11-10T17:17:23.017","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-10T11:16:40.290","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-119446.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/3131f1701194b581ab4b3e5e9d81194fc9c83508"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/e6bf11a812d7aa8b69d854ba8ef02d65516f5564"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-9vr9-463q-46qp"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-119446"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-384"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHub.Accounts'","'Elixir.NervesHubWeb.Router'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub/accounts.ex","lib/nerves_hub_web/router.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.UserController':cli_session/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':check_cli_session/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli_confirm/2"},{"name":"'Elixir.NervesHub.Accounts':generate_cli_session_token/1"},{"name":"'Elixir.NervesHub.Accounts':cli_session_waiting?/2"},{"name":"'Elixir.NervesHub.Accounts':verify_cli_session_token/2"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"2.5.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHub.Accounts'","'Elixir.NervesHubWeb.Router'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub/accounts.ex","lib/nerves_hub_web/router.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.UserController':cli_session/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':check_cli_session/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli_confirm/2"},{"name":"'Elixir.NervesHub.Accounts':generate_cli_session_token/1"},{"name":"'Elixir.NervesHub.Accounts':cli_session_waiting?/2"},{"name":"'Elixir.NervesHub.Accounts':verify_cli_session_token/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"2.5.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHub.Accounts'","'Elixir.NervesHubWeb.Router'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub/accounts.ex","lib/nerves_hub_web/router.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.UserController':cli_session/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':check_cli_session/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli/2"},{"name":"'Elixir.NervesHubWeb.SessionController':cli_confirm/2"},{"name":"'Elixir.NervesHub.Accounts':generate_cli_session_token/1"},{"name":"'Elixir.NervesHub.Accounts':cli_session_waiting?/2"},{"name":"'Elixir.NervesHub.Accounts':verify_cli_session_token/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"3131f1701194b581ab4b3e5e9d81194fc9c83508","status":"affected","version":"e6bf11a812d7aa8b69d854ba8ef02d65516f5564","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user's account and stores it on the login, and the next poll of GET /api/auth/cli_session/ returns it to whoever started the login.\n\nThe confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves.\n\nThis issue affects nerves_hub: from 2.5.0 before 2.5.3."}],"id":"CVE-2026-119446","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119446","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:48:38.519155Z","version":"2.0.3"}}]},"published":"2026-11-10T11:16:40.290","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-119446.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/3131f1701194b581ab4b3e5e9d81194fc9c83508"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/e6bf11a812d7aa8b69d854ba8ef02d65516f5564"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-9vr9-463q-46qp"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-119446"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-9vr9-463q-46qp"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-384"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119474.json b/data/2026/CVE-2026-119474.json index 9b5cecf5b5..083574ff0e 100644 --- a/data/2026/CVE-2026-119474.json +++ b/data/2026/CVE-2026-119474.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Liman Render Engine","vendor":"HAVELSAN Inc.","versions":[{"lessThan":"1.2-81","status":"affected","version":"0","versionType":"custom"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation.\n\nThis issue affects Liman Render Engine: before 1.2-81."}],"id":"CVE-2026-119474","lastModified":"2026-11-10T16:24:34.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-09T15:17:07.140","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1489"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Liman Render Engine","vendor":"HAVELSAN Inc.","versions":[{"lessThan":"1.2-81","status":"affected","version":"0","versionType":"custom"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation.\n\nThis issue affects Liman Render Engine: before 1.2-81."}],"id":"CVE-2026-119474","lastModified":"2026-11-12T17:17:27.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119474","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:20:41.102726Z","version":"2.0.3"}}]},"published":"2026-11-09T15:17:07.140","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1489"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"iletisim@usom.gov.tr","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119529.json b/data/2026/CVE-2026-119529.json index 573c503d72..3bcb6c7260 100644 --- a/data/2026/CVE-2026-119529.json +++ b/data/2026/CVE-2026-119529.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Gravity Forms","vendor":"Unknown","versions":[{"lessThan":"3.2.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled."}],"id":"CVE-2026-119529","lastModified":"2026-11-11T12:19:14.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:21:37.641866Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.207","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/f0fd3993-fdce-454b-92d3-6264cf23dc68/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Gravity Forms","vendor":"Unknown","versions":[{"lessThan":"3.2.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled."}],"id":"CVE-2026-119529","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:21:37.641866Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.207","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/f0fd3993-fdce-454b-92d3-6264cf23dc68/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119531.json b/data/2026/CVE-2026-119531.json index 0cf575d3ff..b8fa6fcc80 100644 --- a/data/2026/CVE-2026-119531.json +++ b/data/2026/CVE-2026-119531.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes before outputting them inside HTML tag attributes, allowing users with the Contributor role and above to store a payload that executes in the browser of anyone who views the post, including an administrator reviewing the pending submission."}],"id":"CVE-2026-119531","lastModified":"2026-11-11T12:19:15.047","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:21:26.262239Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.330","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/493ae475-0595-4421-812e-304315457329/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes before outputting them inside HTML tag attributes, allowing users with the Contributor role and above to store a payload that executes in the browser of anyone who views the post, including an administrator reviewing the pending submission."}],"id":"CVE-2026-119531","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:21:26.262239Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.330","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/493ae475-0595-4421-812e-304315457329/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119610.json b/data/2026/CVE-2026-119610.json index 9686439d74..4f22059cd0 100644 --- a/data/2026/CVE-2026-119610.json +++ b/data/2026/CVE-2026-119610.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents."}],"id":"CVE-2026-119610","lastModified":"2026-11-09T13:17:06.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-09T13:17:05.947","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-119610"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563952"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5310"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0095.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-good","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-time aggregation RTP packets, a signed/unsigned integer conversion error causes the remaining-length counter to underflow to a large positive value when the packet is truncated. This allows a remote, unauthenticated attacker to trigger an out-of-bounds heap read of up to approximately 64 KiB of process memory by sending a single malformed RTP packet. Successful exploitation can crash the receiving GStreamer pipeline (denial of service), and in relay or transcoding deployments where output is accessible to the attacker, may expose adjacent heap contents."}],"id":"CVE-2026-119610","lastModified":"2026-11-12T20:18:20.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119610","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:05:41.519156Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:05.947","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-119610"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563952"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5310"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0095.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119613.json b/data/2026/CVE-2026-119613.json index faf1bb2b1f..bcd4c944b3 100644 --- a/data/2026/CVE-2026-119613.json +++ b/data/2026/CVE-2026-119613.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError'","'Elixir.AshAi.Tool.Errors'","'Elixir.AshAi.Mcp.Router'","'Elixir.AshAi.ToolLoop'"],"packageName":"ash_ai","packageURL":"pkg:hex/ash_ai","product":"ash_ai","programFiles":["lib/ash_ai/to_tool_error.ex","lib/ash_ai/tool/errors.ex","lib/ash_ai/mcp/router.ex","lib/ash_ai/tool_loop.ex"],"programRoutines":[{"name":"'Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError':to_tool_error/1"},{"name":"'Elixir.AshAi.Tool.Errors':format/1"},{"name":"'Elixir.AshAi.Mcp.Router':call/2"},{"name":"'Elixir.AshAi.ToolLoop':run/2"}],"repo":"https://github.com/ash-project/ash_ai","vendor":"ash-project","versions":[{"lessThan":"1.5.1","status":"affected","version":"1.5.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError'","'Elixir.AshAi.Tool.Errors'","'Elixir.AshAi.Mcp.Router'","'Elixir.AshAi.ToolLoop'"],"packageName":"ash-project/ash_ai","packageURL":"pkg:github/ash-project/ash_ai","product":"ash_ai","programFiles":["lib/ash_ai/to_tool_error.ex","lib/ash_ai/tool/errors.ex","lib/ash_ai/mcp/router.ex","lib/ash_ai/tool_loop.ex"],"programRoutines":[{"name":"'Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError':to_tool_error/1"},{"name":"'Elixir.AshAi.Tool.Errors':format/1"},{"name":"'Elixir.AshAi.Mcp.Router':call/2"},{"name":"'Elixir.AshAi.ToolLoop':run/2"}],"repo":"https://github.com/ash-project/ash_ai","vendor":"ash-project","versions":[{"lessThan":"af7987769d78ed070c8a9f6e6ee542d91744eae6","status":"affected","version":"fbad04e9620ef70603f4e67e03f15092f58578f6","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.\n\nAshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error's error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.\n\nThis issue affects ash_ai: from 1.5.0 before 1.5.1."}],"id":"CVE-2026-119613","lastModified":"2026-11-09T13:17:06.257","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-09T13:17:06.257","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-119613.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ash-project/ash_ai/commit/af7987769d78ed070c8a9f6e6ee542d91744eae6"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ash-project/ash_ai/commit/fbad04e9620ef70603f4e67e03f15092f58578f6"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ash-project/ash_ai/security/advisories/GHSA-vhmw-fwrr-r6c6"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-119613"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError'","'Elixir.AshAi.Tool.Errors'","'Elixir.AshAi.Mcp.Router'","'Elixir.AshAi.ToolLoop'"],"packageName":"ash_ai","packageURL":"pkg:hex/ash_ai","product":"ash_ai","programFiles":["lib/ash_ai/to_tool_error.ex","lib/ash_ai/tool/errors.ex","lib/ash_ai/mcp/router.ex","lib/ash_ai/tool_loop.ex"],"programRoutines":[{"name":"'Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError':to_tool_error/1"},{"name":"'Elixir.AshAi.Tool.Errors':format/1"},{"name":"'Elixir.AshAi.Mcp.Router':call/2"},{"name":"'Elixir.AshAi.ToolLoop':run/2"}],"repo":"https://github.com/ash-project/ash_ai","vendor":"ash-project","versions":[{"lessThan":"1.5.1","status":"affected","version":"1.5.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError'","'Elixir.AshAi.Tool.Errors'","'Elixir.AshAi.Mcp.Router'","'Elixir.AshAi.ToolLoop'"],"packageName":"ash-project/ash_ai","packageURL":"pkg:github/ash-project/ash_ai","product":"ash_ai","programFiles":["lib/ash_ai/to_tool_error.ex","lib/ash_ai/tool/errors.ex","lib/ash_ai/mcp/router.ex","lib/ash_ai/tool_loop.ex"],"programRoutines":[{"name":"'Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError':to_tool_error/1"},{"name":"'Elixir.AshAi.Tool.Errors':format/1"},{"name":"'Elixir.AshAi.Mcp.Router':call/2"},{"name":"'Elixir.AshAi.ToolLoop':run/2"}],"repo":"https://github.com/ash-project/ash_ai","vendor":"ash-project","versions":[{"lessThan":"af7987769d78ed070c8a9f6e6ee542d91744eae6","status":"affected","version":"fbad04e9620ef70603f4e67e03f15092f58578f6","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.\n\nAshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error's error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.\n\nThis issue affects ash_ai: from 1.5.0 before 1.5.1."}],"id":"CVE-2026-119613","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119613","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:10:54.442769Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:06.257","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-119613.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ash-project/ash_ai/commit/af7987769d78ed070c8a9f6e6ee542d91744eae6"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ash-project/ash_ai/commit/fbad04e9620ef70603f4e67e03f15092f58578f6"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/ash-project/ash_ai/security/advisories/GHSA-vhmw-fwrr-r6c6"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-119613"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/ash-project/ash_ai/security/advisories/GHSA-vhmw-fwrr-r6c6"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119618.json b/data/2026/CVE-2026-119618.json index 1c9d213bc8..94c1db98c2 100644 --- a/data/2026/CVE-2026-119618.json +++ b/data/2026/CVE-2026-119618.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}],"id":"CVE-2026-119618","lastModified":"2026-11-12T10:17:28.360","metrics":{},"published":"2026-11-11T15:17:15.900","references":[{"source":"security@apache.org","url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/security/cve/cve-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://bugs.gentoo.org/986161"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/AlmaLinux/updates/issues/4252"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/microsoft/azurelinux/pull/20165"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}],"id":"CVE-2026-119618","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-11T15:17:15.900","references":[{"source":"security@apache.org","url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/security/cve/cve-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://bugs.gentoo.org/986161"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/AlmaLinux/updates/issues/4252"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/microsoft/azurelinux/pull/20165"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119723.json b/data/2026/CVE-2026-119723.json index 8661540b7d..c8bd32210f 100644 --- a/data/2026/CVE-2026-119723.json +++ b/data/2026/CVE-2026-119723.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HHVM","vendor":"Facebook","versions":[{"lessThan":"23c061f4e804a51badd5f85227e65185651253b5","status":"affected","version":"0","versionType":"git"}]}],"source":"cve-assign@fb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5."}],"id":"CVE-2026-119723","lastModified":"2026-11-11T17:17:17.220","metrics":{},"published":"2026-11-11T17:17:17.220","references":[{"source":"cve-assign@fb.com","url":"https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5"},{"source":"cve-assign@fb.com","url":"https://www.facebook.com/security/advisories/cve-2026-119723"}],"sourceIdentifier":"cve-assign@fb.com","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HHVM","vendor":"Facebook","versions":[{"lessThan":"23c061f4e804a51badd5f85227e65185651253b5","status":"affected","version":"0","versionType":"git"}]}],"source":"cve-assign@fb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5."}],"id":"CVE-2026-119723","lastModified":"2026-11-12T20:04:52.377","metrics":{},"published":"2026-11-11T17:17:17.220","references":[{"source":"cve-assign@fb.com","url":"https://github.com/meta/hhvm/commit/23c061f4e804a51badd5f85227e65185651253b5"},{"source":"cve-assign@fb.com","url":"https://www.facebook.com/security/advisories/cve-2026-119723"}],"sourceIdentifier":"cve-assign@fb.com","vulnStatus":"Awaiting Analysis"} diff --git a/data/2026/CVE-2026-119759.json b/data/2026/CVE-2026-119759.json index b5300fbba9..1aac928ec8 100644 --- a/data/2026/CVE-2026-119759.json +++ b/data/2026/CVE-2026-119759.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/trailbaseio/trailbase","product":"trailbase","repo":"https://github.com/trailbaseio/trailbase","vendor":"trailbaseio","versions":[{"lessThan":"0.35.10","status":"affected","version":"0.28.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers can reference another user's or table's file id in a record they own to read the victim's file bytes through their own record, or trigger permanent deletion of the victim's file by deleting or nulling their own record, while also using a $like filter on the file column to brute-force recover stripped ids character by character."}],"id":"CVE-2026-119759","lastModified":"2026-11-10T17:17:23.160","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:05:46.778782Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:28.620","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/trailbaseio/trailbase/releases#release-v0.35.10"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/trailbase-idor-via-record-api-file-column"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/trailbaseio/trailbase","product":"trailbase","repo":"https://github.com/trailbaseio/trailbase","vendor":"trailbaseio","versions":[{"lessThan":"0.35.10","status":"affected","version":"0.28.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference in std.FileUpload columns, where the Record API accepts attacker-supplied object-store file ids on insert and update without ownership validation. An authenticated attacker who can read a victim’s row can recover its stripped file id via a $like filter and then permanently delete or orphan the victim’s file by deleting or nulling a record they own."}],"id":"CVE-2026-119759","lastModified":"2026-11-12T18:17:16.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:05:46.778782Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:28.620","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/trailbaseio/trailbase/releases#release-v0.35.10"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/trailbase-idor-via-record-api-file-column"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119832.json b/data/2026/CVE-2026-119832.json index 33d6d35f08..3555b8e625 100644 --- a/data/2026/CVE-2026-119832.json +++ b/data/2026/CVE-2026-119832.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack."}],"id":"CVE-2026-119832","lastModified":"2026-11-11T18:19:24.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.2,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119832","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:19:22.565437Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:58.670","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119832"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack."}],"id":"CVE-2026-119832","lastModified":"2026-11-12T20:18:20.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.2,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119832","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:19:22.565437Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:58.670","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119832"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119923.json b/data/2026/CVE-2026-119923.json index 5605fc5a28..14ad50703c 100644 --- a/data/2026/CVE-2026-119923.json +++ b/data/2026/CVE-2026-119923.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"babelfish-for-postgresql","vendor":"AWS","versions":[{"lessThanOrEqual":"1.5","status":"affected","version":"1.0","versionType":"custom"},{"lessThanOrEqual":"2.15","status":"affected","version":"2.1","versionType":"custom"},{"lessThanOrEqual":"3.12","status":"affected","version":"3.1","versionType":"custom"},{"lessThanOrEqual":"4.8","status":"affected","version":"4.0","versionType":"custom"},{"lessThanOrEqual":"5.4","status":"affected","version":"5.1","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Amazon Aurora PostgreSQL with Babelfish","vendor":"Amazon","versions":[{"lessThan":"1.5.5","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThan":"1.17.2","status":"affected","version":"1.6.0","versionType":"custom"},{"lessThan":"2.3.5","status":"affected","version":"2.0.0","versionType":"custom"},{"lessThan":"2.12.4","status":"affected","version":"2.4.0","versionType":"custom"},{"lessThan":"2.13.3","status":"affected","version":"2.13.0","versionType":"custom"},{"lessThan":"2.14.2","status":"affected","version":"2.14.0","versionType":"custom"},{"lessThan":"2.15.2","status":"affected","version":"2.15.0","versionType":"custom"},{"lessThan":"2.16.1","status":"affected","version":"2.16.0","versionType":"custom"},{"lessThan":"3.8.4","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"3.9.4","status":"affected","version":"3.9.0","versionType":"custom"},{"lessThan":"3.10.3","status":"affected","version":"3.10.0","versionType":"custom"},{"lessThan":"3.11.2","status":"affected","version":"3.11.0","versionType":"custom"},{"lessThan":"3.12.2","status":"affected","version":"3.12.0","versionType":"custom"},{"lessThan":"3.13.1","status":"affected","version":"3.13.0","versionType":"custom"},{"lessThan":"4.5.5","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.6.3","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.7.2","status":"affected","version":"4.7.0","versionType":"custom"},{"lessThan":"4.8.2","status":"affected","version":"4.8.0","versionType":"custom"},{"lessThan":"4.9.1","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"5.1.4","status":"affected","version":"5.0.0","versionType":"custom"},{"lessThan":"5.2.3","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.2","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.4.2","status":"affected","version":"5.4.0","versionType":"custom"},{"status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"6.0.2","status":"affected","version":"6.0.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser.\n\n\n\nTo remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch."}],"id":"CVE-2026-119923","lastModified":"2026-11-07T22:16:34.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119923","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:26:32.395882Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:39.360","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-166-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-vq28-vgj3-r26w"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"babelfish-for-postgresql","vendor":"AWS","versions":[{"lessThanOrEqual":"1.5","status":"affected","version":"1.0","versionType":"custom"},{"lessThanOrEqual":"2.15","status":"affected","version":"2.1","versionType":"custom"},{"lessThanOrEqual":"3.12","status":"affected","version":"3.1","versionType":"custom"},{"lessThanOrEqual":"4.8","status":"affected","version":"4.0","versionType":"custom"},{"lessThanOrEqual":"5.4","status":"affected","version":"5.1","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Amazon Aurora PostgreSQL with Babelfish","vendor":"Amazon","versions":[{"lessThan":"1.5.5","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThan":"1.17.2","status":"affected","version":"1.6.0","versionType":"custom"},{"lessThan":"2.3.5","status":"affected","version":"2.0.0","versionType":"custom"},{"lessThan":"2.12.4","status":"affected","version":"2.4.0","versionType":"custom"},{"lessThan":"2.13.3","status":"affected","version":"2.13.0","versionType":"custom"},{"lessThan":"2.14.2","status":"affected","version":"2.14.0","versionType":"custom"},{"lessThan":"2.15.2","status":"affected","version":"2.15.0","versionType":"custom"},{"lessThan":"2.16.1","status":"affected","version":"2.16.0","versionType":"custom"},{"lessThan":"3.8.4","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"3.9.4","status":"affected","version":"3.9.0","versionType":"custom"},{"lessThan":"3.10.3","status":"affected","version":"3.10.0","versionType":"custom"},{"lessThan":"3.11.2","status":"affected","version":"3.11.0","versionType":"custom"},{"lessThan":"3.12.2","status":"affected","version":"3.12.0","versionType":"custom"},{"lessThan":"3.13.1","status":"affected","version":"3.13.0","versionType":"custom"},{"lessThan":"4.5.5","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.6.3","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.7.2","status":"affected","version":"4.7.0","versionType":"custom"},{"lessThan":"4.8.2","status":"affected","version":"4.8.0","versionType":"custom"},{"lessThan":"4.9.1","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"5.1.4","status":"affected","version":"5.0.0","versionType":"custom"},{"lessThan":"5.2.3","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.2","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.4.2","status":"affected","version":"5.4.0","versionType":"custom"},{"status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"6.0.2","status":"affected","version":"6.0.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser.\n\n\n\nTo remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch."}],"id":"CVE-2026-119923","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119923","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:26:32.395882Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:39.360","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-166-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-vq28-vgj3-r26w"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119924.json b/data/2026/CVE-2026-119924.json index 8e80596f86..c1091604fc 100644 --- a/data/2026/CVE-2026-119924.json +++ b/data/2026/CVE-2026-119924.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"babelfish-for-postgresql","vendor":"AWS","versions":[{"lessThanOrEqual":"1.5","status":"affected","version":"1.0","versionType":"custom"},{"lessThanOrEqual":"2.15","status":"affected","version":"2.1","versionType":"custom"},{"lessThanOrEqual":"3.12","status":"affected","version":"3.1","versionType":"custom"},{"lessThanOrEqual":"4.8","status":"affected","version":"4.0","versionType":"custom"},{"lessThanOrEqual":"5.4","status":"affected","version":"5.1","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Amazon Aurora PostgreSQL with Babelfish","vendor":"Amazon","versions":[{"lessThan":"1.5.5","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThan":"1.17.2","status":"affected","version":"1.6.0","versionType":"custom"},{"lessThan":"2.3.5","status":"affected","version":"2.0.0","versionType":"custom"},{"lessThan":"2.12.4","status":"affected","version":"2.4.0","versionType":"custom"},{"lessThan":"2.13.3","status":"affected","version":"2.13.0","versionType":"custom"},{"lessThan":"2.14.2","status":"affected","version":"2.14.0","versionType":"custom"},{"lessThan":"2.15.2","status":"affected","version":"2.15.0","versionType":"custom"},{"lessThan":"2.16.1","status":"affected","version":"2.16.0","versionType":"custom"},{"lessThan":"3.8.4","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"3.9.4","status":"affected","version":"3.9.0","versionType":"custom"},{"lessThan":"3.10.3","status":"affected","version":"3.10.0","versionType":"custom"},{"lessThan":"3.11.2","status":"affected","version":"3.11.0","versionType":"custom"},{"lessThan":"3.12.2","status":"affected","version":"3.12.0","versionType":"custom"},{"lessThan":"3.13.1","status":"affected","version":"3.13.0","versionType":"custom"},{"lessThan":"4.5.5","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.6.3","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.7.2","status":"affected","version":"4.7.0","versionType":"custom"},{"lessThan":"4.8.2","status":"affected","version":"4.8.0","versionType":"custom"},{"lessThan":"4.9.1","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"5.1.4","status":"affected","version":"5.0.0","versionType":"custom"},{"lessThan":"5.2.3","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.2","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.4.2","status":"affected","version":"5.4.0","versionType":"custom"},{"status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"6.0.2","status":"affected","version":"6.0.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the TDS port (default 1433).\n\n\n\nTo remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch."}],"id":"CVE-2026-119924","lastModified":"2026-11-07T22:16:35.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119924","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:21:08.740024Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:39.593","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-166-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-cv9q-3h4j-rv5m"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"babelfish-for-postgresql","vendor":"AWS","versions":[{"lessThanOrEqual":"1.5","status":"affected","version":"1.0","versionType":"custom"},{"lessThanOrEqual":"2.15","status":"affected","version":"2.1","versionType":"custom"},{"lessThanOrEqual":"3.12","status":"affected","version":"3.1","versionType":"custom"},{"lessThanOrEqual":"4.8","status":"affected","version":"4.0","versionType":"custom"},{"lessThanOrEqual":"5.4","status":"affected","version":"5.1","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Amazon Aurora PostgreSQL with Babelfish","vendor":"Amazon","versions":[{"lessThan":"1.5.5","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThan":"1.17.2","status":"affected","version":"1.6.0","versionType":"custom"},{"lessThan":"2.3.5","status":"affected","version":"2.0.0","versionType":"custom"},{"lessThan":"2.12.4","status":"affected","version":"2.4.0","versionType":"custom"},{"lessThan":"2.13.3","status":"affected","version":"2.13.0","versionType":"custom"},{"lessThan":"2.14.2","status":"affected","version":"2.14.0","versionType":"custom"},{"lessThan":"2.15.2","status":"affected","version":"2.15.0","versionType":"custom"},{"lessThan":"2.16.1","status":"affected","version":"2.16.0","versionType":"custom"},{"lessThan":"3.8.4","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"3.9.4","status":"affected","version":"3.9.0","versionType":"custom"},{"lessThan":"3.10.3","status":"affected","version":"3.10.0","versionType":"custom"},{"lessThan":"3.11.2","status":"affected","version":"3.11.0","versionType":"custom"},{"lessThan":"3.12.2","status":"affected","version":"3.12.0","versionType":"custom"},{"lessThan":"3.13.1","status":"affected","version":"3.13.0","versionType":"custom"},{"lessThan":"4.5.5","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.6.3","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.7.2","status":"affected","version":"4.7.0","versionType":"custom"},{"lessThan":"4.8.2","status":"affected","version":"4.8.0","versionType":"custom"},{"lessThan":"4.9.1","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"5.1.4","status":"affected","version":"5.0.0","versionType":"custom"},{"lessThan":"5.2.3","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.2","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.4.2","status":"affected","version":"5.4.0","versionType":"custom"},{"status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"6.0.2","status":"affected","version":"6.0.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the TDS port (default 1433).\n\n\n\nTo remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. As a workaround, restrict network access to the TDS port (default 1433). Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch."}],"id":"CVE-2026-119924","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119924","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:21:08.740024Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:39.593","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-166-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-cv9q-3h4j-rv5m"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120012.json b/data/2026/CVE-2026-120012.json index 8c69abf637..ad1daacb1a 100644 --- a/data/2026/CVE-2026-120012.json +++ b/data/2026/CVE-2026-120012.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP Cloud SDK for AI(JavaScript)","vendor":"SAP_SE","versions":[{"status":"affected","version":"<= v2.17.0"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these credentials, but only after waiting for a suitable failure event triggered by a higher-privileged user and within the limited lifetime of the token, making exploitation complex. Successful exploitation could allow the attacker to reuse the disclosed credentials against the associated SAP service, resulting in a high impact on confidentiality, integrity and availability."}],"id":"CVE-2026-120012","lastModified":"2026-11-10T22:11:23.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cna@sap.com","type":"Primary"}]},"published":"2026-11-10T09:17:22.140","references":[{"source":"cna@sap.com","url":"https://github.com/SAP/ai-sdk-js/security/advisories/GHSA-8g7j-49xg-8wf3"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"}],"source":"cna@sap.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP Cloud SDK for AI(JavaScript)","vendor":"SAP_SE","versions":[{"status":"affected","version":"<= v2.17.0"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forwarded error output could obtain these credentials, but only after waiting for a suitable failure event triggered by a higher-privileged user and within the limited lifetime of the token, making exploitation complex. Successful exploitation could allow the attacker to reuse the disclosed credentials against the associated SAP service, resulting in a high impact on confidentiality, integrity and availability."}],"id":"CVE-2026-120012","lastModified":"2026-11-12T18:17:17.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120012","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:42:13.882042Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:22.140","references":[{"source":"cna@sap.com","url":"https://github.com/SAP/ai-sdk-js/security/advisories/GHSA-8g7j-49xg-8wf3"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"}],"source":"cna@sap.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120013.json b/data/2026/CVE-2026-120013.json index 9208f4209d..bc964e8069 100644 --- a/data/2026/CVE-2026-120013.json +++ b/data/2026/CVE-2026-120013.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP Cloud SDK for Python","vendor":"SAP_SE","versions":[{"status":"affected","version":"< 0.50.0"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp) could cause the resolved path to escape the intended directory and access another tenant's secrets under:Plain Text/etc/secrets/appfnd/hana-agent-memory//Successful exploitation could allow unauthorized access to another tenant's mounted credentials, including OAuth client IDs and client secrets. This vulnerability could enable cross-tenant access to sensitive credentials."}],"id":"CVE-2026-120013","lastModified":"2026-11-10T22:11:23.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Primary"}]},"published":"2026-11-10T09:17:22.303","references":[{"source":"cna@sap.com","url":"https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-28c8-457r-4cf6"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cna@sap.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP Cloud SDK for Python","vendor":"SAP_SE","versions":[{"status":"affected","version":"< 0.50.0"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp) could cause the resolved path to escape the intended directory and access another tenant's secrets under:Plain Text/etc/secrets/appfnd/hana-agent-memory//Successful exploitation could allow unauthorized access to another tenant's mounted credentials, including OAuth client IDs and client secrets. This vulnerability could enable cross-tenant access to sensitive credentials."}],"id":"CVE-2026-120013","lastModified":"2026-11-12T18:17:17.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120013","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:43:25.914828Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:22.303","references":[{"source":"cna@sap.com","url":"https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-28c8-457r-4cf6"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cna@sap.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120033.json b/data/2026/CVE-2026-120033.json new file mode 100644 index 0000000000..c38beb92e5 --- /dev/null +++ b/data/2026/CVE-2026-120033.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["bgpd"],"product":"frrouting","programFiles":["bgpd/bgp_fsm.c"],"programRoutines":[{"name":"bgp_event_stop_with_notify"}],"repo":"https://github.com/FRRouting/frr/","vendor":"frrouting","versions":[{"changes":[{"at":"57a7f3eb48837359d6e3ee5ebd4acea8f49320e5","status":"unaffected"}],"lessThan":"*","status":"affected","version":"4967bf6d729d7dd14dff7b672b2fd4afe78a0d86","versionType":"git"}]}],"source":"57a55968-44ac-464c-a794-6ba3baad09c4"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up.\n\n\nA BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can cause one of the following:\n\n * If the neighbor announced Graceful Restart support: bgpd crashes shortly after the session is closed (after the neighbor's announced restart time plus one keepalive interval), taking down all BGP sessions on the router. The neighbor can repeat this each time bgpd restarts.\n * Otherwise: the session stays stuck in the Established state. The neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator runs \"clear bgp \".\n\nThe neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior.\n\n\nRequired configuration: no special configuration is needed. Any BGP neighbor with an established session can trigger the issue under default settings, for example:\n\n router bgp 65001\n neighbor 192.0.2.2 remote-as 65002\n\nGraceful Restart helper mode, which leads to the crash, is enabled by default. With default timers (keepalive 60s, hold time 180s), the session is closed about 6 minutes after the neighbor stops reading."}],"id":"CVE-2026-120033","lastModified":"2026-11-12T19:16:48.393","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary"}]},"published":"2026-11-12T19:16:48.393","references":[{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","url":"https://github.com/FRRouting/frr/pull/23945/changes/57a7f3eb48837359d6e3ee5ebd4acea8f49320e5"}],"sourceIdentifier":"57a55968-44ac-464c-a794-6ba3baad09c4","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-372"},{"lang":"en","value":"CWE-617"}],"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120139.json b/data/2026/CVE-2026-120139.json index d834e5802c..0c661403c2 100644 --- a/data/2026/CVE-2026-120139.json +++ b/data/2026/CVE-2026-120139.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120139","lastModified":"2026-11-12T15:17:42.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.420","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120139/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120139","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.420","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120139/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120141.json b/data/2026/CVE-2026-120141.json index 60e7193234..9b337888e3 100644 --- a/data/2026/CVE-2026-120141.json +++ b/data/2026/CVE-2026-120141.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120141","lastModified":"2026-11-12T15:17:42.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.547","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120141/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120141","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.547","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120141/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120142.json b/data/2026/CVE-2026-120142.json index 52bd240da2..9e44ac36b4 100644 --- a/data/2026/CVE-2026-120142.json +++ b/data/2026/CVE-2026-120142.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-120142","lastModified":"2026-11-12T15:17:42.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.660","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120142/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-120142","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.660","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120142/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120143.json b/data/2026/CVE-2026-120143.json index f29910defc..90dbf13aa2 100644 --- a/data/2026/CVE-2026-120143.json +++ b/data/2026/CVE-2026-120143.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120143","lastModified":"2026-11-12T15:17:42.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.790","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120143/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120143","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.790","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120143/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120144.json b/data/2026/CVE-2026-120144.json index 7024417ed6..7705ae1ee5 100644 --- a/data/2026/CVE-2026-120144.json +++ b/data/2026/CVE-2026-120144.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-120144","lastModified":"2026-11-12T15:17:42.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.930","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120144/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-120144","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.930","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120144/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120145.json b/data/2026/CVE-2026-120145.json index a67ef351ab..c5050753b7 100644 --- a/data/2026/CVE-2026-120145.json +++ b/data/2026/CVE-2026-120145.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120145","lastModified":"2026-11-12T15:17:43.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.060","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120145/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120145","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.060","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120145/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120146.json b/data/2026/CVE-2026-120146.json index 2f6c69b25d..e8129c9cf9 100644 --- a/data/2026/CVE-2026-120146.json +++ b/data/2026/CVE-2026-120146.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120146","lastModified":"2026-11-12T15:17:43.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.193","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120146/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120146","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.193","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120146/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120147.json b/data/2026/CVE-2026-120147.json index 817a51fd5c..cc6e156658 100644 --- a/data/2026/CVE-2026-120147.json +++ b/data/2026/CVE-2026-120147.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120147","lastModified":"2026-11-12T15:17:43.317","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.317","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120147/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120147","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.317","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120147/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120148.json b/data/2026/CVE-2026-120148.json index 384a692b6a..d2964fac6b 100644 --- a/data/2026/CVE-2026-120148.json +++ b/data/2026/CVE-2026-120148.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120148","lastModified":"2026-11-12T15:17:43.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.443","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120148/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120148","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.443","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120148/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120149.json b/data/2026/CVE-2026-120149.json index b9b38a5e90..d7328b06b3 100644 --- a/data/2026/CVE-2026-120149.json +++ b/data/2026/CVE-2026-120149.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120149","lastModified":"2026-11-12T15:17:43.567","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.567","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120149/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120149","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.567","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120149/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120150.json b/data/2026/CVE-2026-120150.json index b986673497..b43d7efde3 100644 --- a/data/2026/CVE-2026-120150.json +++ b/data/2026/CVE-2026-120150.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120150","lastModified":"2026-11-12T15:17:43.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.687","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120150/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120150","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.687","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120150/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120151.json b/data/2026/CVE-2026-120151.json index 325c828406..f18a20b4ef 100644 --- a/data/2026/CVE-2026-120151.json +++ b/data/2026/CVE-2026-120151.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120151","lastModified":"2026-11-12T15:17:43.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.817","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120151/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120151","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.817","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120151/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120152.json b/data/2026/CVE-2026-120152.json index 766b602997..85648d49b6 100644 --- a/data/2026/CVE-2026-120152.json +++ b/data/2026/CVE-2026-120152.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."}],"id":"CVE-2026-120152","lastModified":"2026-11-12T15:17:43.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.940","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120152/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."}],"id":"CVE-2026-120152","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.940","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120152/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120153.json b/data/2026/CVE-2026-120153.json index ed1690ac90..517b0ee814 100644 --- a/data/2026/CVE-2026-120153.json +++ b/data/2026/CVE-2026-120153.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120153","lastModified":"2026-11-12T15:17:44.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:44.073","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120153/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120153","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:44.073","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120153/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120154.json b/data/2026/CVE-2026-120154.json index 44bfe25059..b67104e0de 100644 --- a/data/2026/CVE-2026-120154.json +++ b/data/2026/CVE-2026-120154.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120154","lastModified":"2026-11-12T15:17:44.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:44.193","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120154/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120154","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:44.193","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120154/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120212.json b/data/2026/CVE-2026-120212.json index 8170eb6259..99d1ce69fc 100644 --- a/data/2026/CVE-2026-120212.json +++ b/data/2026/CVE-2026-120212.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Web::Simple"],"packageName":"Web-Simple","packageURL":"pkg:cpan/Web-Simple","programFiles":["lib/XML/Tags.pm"],"programRoutines":[{"name":"XML::Tags::to_xml_string"}],"repo":"https://github.com/p5sagit/Web-Simple","versions":[{"lessThan":"0.037","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.\n\nHTML::Tags and XML::Tags escape a plain string value by replacing only &, \", < and > with entities. A value interpolated into a single-quoted attribute, as in , can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.\n\nAn attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page."}],"id":"CVE-2026-120212","lastModified":"2026-11-10T18:17:19.447","metrics":{},"published":"2026-11-10T18:17:19.447","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/ETHER/Web-Simple-0.037/changes"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://www.cve.org/CVERecord?id=CVE-2026-5090"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Web::Simple"],"packageName":"Web-Simple","packageURL":"pkg:cpan/Web-Simple","programFiles":["lib/XML/Tags.pm"],"programRoutines":[{"name":"XML::Tags::to_xml_string"}],"repo":"https://github.com/p5sagit/Web-Simple","versions":[{"lessThan":"0.037","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.\n\nHTML::Tags and XML::Tags escape a plain string value by replacing only &, \", < and > with entities. A value interpolated into a single-quoted attribute, as in , can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.\n\nAn attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page."}],"id":"CVE-2026-120212","lastModified":"2026-11-12T20:07:11.090","metrics":{},"published":"2026-11-10T18:17:19.447","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/ETHER/Web-Simple-0.037/changes"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://www.cve.org/CVERecord?id=CVE-2026-5090"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120286.json b/data/2026/CVE-2026-120286.json index ccbb5e6c81..081ff75a75 100644 --- a/data/2026/CVE-2026-120286.json +++ b/data/2026/CVE-2026-120286.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab'","'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'","'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/components/device_page/details_tab.ex","lib/nerves_hub_web/live/deployment_groups/show.ex","lib/nerves_hub_web/components/deployment_group_page/summary.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':handle_progress/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.DeploymentGroups.Show':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_progress/3"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab'","'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'","'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/components/device_page/details_tab.ex","lib/nerves_hub_web/live/deployment_groups/show.ex","lib/nerves_hub_web/components/deployment_group_page/summary.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':handle_progress/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.DeploymentGroups.Show':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_progress/3"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab'","'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'","'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/components/device_page/details_tab.ex","lib/nerves_hub_web/live/deployment_groups/show.ex","lib/nerves_hub_web/components/deployment_group_page/summary.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':handle_progress/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.DeploymentGroups.Show':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_progress/3"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"34ea112472a460319c1e1dec8ad0ffc37df05ffe","status":"affected","version":"7b511764a468bb2c1f33945874faa86af2255c0c","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member.\n\nA view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."}],"id":"CVE-2026-120286","lastModified":"2026-11-11T20:17:05.647","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-10T11:16:41.647","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-120286.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/34ea112472a460319c1e1dec8ad0ffc37df05ffe"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/7b511764a468bb2c1f33945874faa86af2255c0c"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-gxj7-m8x6-r644"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-120286"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab'","'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'","'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/components/device_page/details_tab.ex","lib/nerves_hub_web/live/deployment_groups/show.ex","lib/nerves_hub_web/components/deployment_group_page/summary.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':handle_progress/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.DeploymentGroups.Show':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_progress/3"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab'","'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'","'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/components/device_page/details_tab.ex","lib/nerves_hub_web/live/deployment_groups/show.ex","lib/nerves_hub_web/components/deployment_group_page/summary.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':handle_progress/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.DeploymentGroups.Show':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_progress/3"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab'","'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'","'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/components/device_page/details_tab.ex","lib/nerves_hub_web/live/deployment_groups/show.ex","lib/nerves_hub_web/components/deployment_group_page/summary.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':handle_progress/3"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.DeploymentGroups.Show':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_progress/3"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"34ea112472a460319c1e1dec8ad0ffc37df05ffe","status":"affected","version":"7b511764a468bb2c1f33945874faa86af2255c0c","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member.\n\nA view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."}],"id":"CVE-2026-120286","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120286","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:47:40.502753Z","version":"2.0.3"}}]},"published":"2026-11-10T11:16:41.647","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-120286.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/34ea112472a460319c1e1dec8ad0ffc37df05ffe"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/7b511764a468bb2c1f33945874faa86af2255c0c"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-gxj7-m8x6-r644"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-120286"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-gxj7-m8x6-r644"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120295.json b/data/2026/CVE-2026-120295.json index ba95a47590..4b83495450 100644 --- a/data/2026/CVE-2026-120295.json +++ b/data/2026/CVE-2026-120295.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Live.Devices.Index'","'Elixir.NervesHub.Products'","'Elixir.NervesHubWeb.Components.BulkActionsSidebar'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/live/devices/index.ex","lib/nerves_hub/products.ex","lib/nerves_hub_web/components/bulk_actions_sidebar.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Live.Devices.Index':handle_event/3"},{"name":"'Elixir.NervesHub.Products':get_by_id/2"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Live.Devices.Index'","'Elixir.NervesHub.Products'","'Elixir.NervesHubWeb.Components.BulkActionsSidebar'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/live/devices/index.ex","lib/nerves_hub/products.ex","lib/nerves_hub_web/components/bulk_actions_sidebar.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Live.Devices.Index':handle_event/3"},{"name":"'Elixir.NervesHub.Products':get_by_id/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Live.Devices.Index'","'Elixir.NervesHub.Products'","'Elixir.NervesHubWeb.Components.BulkActionsSidebar'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/live/devices/index.ex","lib/nerves_hub/products.ex","lib/nerves_hub_web/components/bulk_actions_sidebar.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Live.Devices.Index':handle_event/3"},{"name":"'Elixir.NervesHub.Products':get_by_id/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"*","status":"affected","version":"adaeefdb7a835525482588f43332ef988cc448c7","versionType":"git"},{"lessThan":"1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa","status":"affected","version":"79743ef08f7f801617b653fd09f37c01ed9b4be0","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the \"Move device(s) to product\" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter.\n\nA moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."}],"id":"CVE-2026-120295","lastModified":"2026-11-11T20:17:05.950","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-10T11:16:41.960","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-120295.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/79743ef08f7f801617b653fd09f37c01ed9b4be0"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/adaeefdb7a835525482588f43332ef988cc448c7"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-120295"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Live.Devices.Index'","'Elixir.NervesHub.Products'","'Elixir.NervesHubWeb.Components.BulkActionsSidebar'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/live/devices/index.ex","lib/nerves_hub/products.ex","lib/nerves_hub_web/components/bulk_actions_sidebar.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Live.Devices.Index':handle_event/3"},{"name":"'Elixir.NervesHub.Products':get_by_id/2"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Live.Devices.Index'","'Elixir.NervesHub.Products'","'Elixir.NervesHubWeb.Components.BulkActionsSidebar'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/live/devices/index.ex","lib/nerves_hub/products.ex","lib/nerves_hub_web/components/bulk_actions_sidebar.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Live.Devices.Index':handle_event/3"},{"name":"'Elixir.NervesHub.Products':get_by_id/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.Live.Devices.Index'","'Elixir.NervesHub.Products'","'Elixir.NervesHubWeb.Components.BulkActionsSidebar'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/live/devices/index.ex","lib/nerves_hub/products.ex","lib/nerves_hub_web/components/bulk_actions_sidebar.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.Live.Devices.Index':handle_event/3"},{"name":"'Elixir.NervesHub.Products':get_by_id/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"*","status":"affected","version":"adaeefdb7a835525482588f43332ef988cc448c7","versionType":"git"},{"lessThan":"1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa","status":"affected","version":"79743ef08f7f801617b653fd09f37c01ed9b4be0","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the \"Move device(s) to product\" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter.\n\nA moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."}],"id":"CVE-2026-120295","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120295","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:43:24.355706Z","version":"2.0.3"}}]},"published":"2026-11-10T11:16:41.960","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-120295.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/79743ef08f7f801617b653fd09f37c01ed9b4be0"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/adaeefdb7a835525482588f43332ef988cc448c7"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-120295"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120367.json b/data/2026/CVE-2026-120367.json index 281bac0d6f..97d10b201f 100644 --- a/data/2026/CVE-2026-120367.json +++ b/data/2026/CVE-2026-120367.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-json","packageURL":"pkg:maven/org.apache.axis2/axis2-json","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable jsonMaxRequestSize parameter. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-120367","lastModified":"2026-11-09T15:17:07.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120367","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:07:31.314580Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:21.720","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/aea2671e3c5ebd8638d37db30d69639223366d5d"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/kf6goprhhtvfzb6lwnbvnors7xnq0w0r"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/26"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-json","packageURL":"pkg:maven/org.apache.axis2/axis2-json","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable jsonMaxRequestSize parameter. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-120367","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120367","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:07:31.314580Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:21.720","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/aea2671e3c5ebd8638d37db30d69639223366d5d"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/kf6goprhhtvfzb6lwnbvnors7xnq0w0r"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/26"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120386.json b/data/2026/CVE-2026-120386.json index c45fb194c5..a4dc1498b6 100644 --- a/data/2026/CVE-2026-120386.json +++ b/data/2026/CVE-2026-120386.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Effekseer","vendor":"Effekseer","versions":[{"lessThanOrEqual":"1.80.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Effekseer improperly validates \"effect\" files. When a crafted effect file is loaded to the affected runtime, the host process may be forced to crash."}],"id":"CVE-2026-120386","lastModified":"2026-11-12T15:17:44.783","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.0"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120386","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:41:54.838669Z","version":"2.0.3"}}]},"published":"2026-11-09T08:17:02.200","references":[{"source":"vultures@jpcert.or.jp","url":"https://github.com/effekseer/Effekseer/commit/6cf1cb853383765153219ba5ce9b47eff5ad8398"},{"source":"vultures@jpcert.or.jp","url":"https://github.com/effekseer/Effekseer/releases/tag/1808"},{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/jp/JVN56286875/"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-237"}],"source":"vultures@jpcert.or.jp","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Effekseer","vendor":"Effekseer","versions":[{"lessThanOrEqual":"1.80.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"vultures@jpcert.or.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Effekseer improperly validates \"effect\" files. When a crafted effect file is loaded to the affected runtime, the host process may be forced to crash."}],"id":"CVE-2026-120386","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.0"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"vultures@jpcert.or.jp","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vultures@jpcert.or.jp","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120386","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:41:54.838669Z","version":"2.0.3"}}]},"published":"2026-11-09T08:17:02.200","references":[{"source":"vultures@jpcert.or.jp","url":"https://github.com/effekseer/Effekseer/commit/6cf1cb853383765153219ba5ce9b47eff5ad8398"},{"source":"vultures@jpcert.or.jp","url":"https://github.com/effekseer/Effekseer/releases/tag/1808"},{"source":"vultures@jpcert.or.jp","url":"https://jvn.jp/en/jp/JVN56286875/"}],"sourceIdentifier":"vultures@jpcert.or.jp","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-237"}],"source":"vultures@jpcert.or.jp","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120421.json b/data/2026/CVE-2026-120421.json index 15b4b064f4..7c3c1557b7 100644 --- a/data/2026/CVE-2026-120421.json +++ b/data/2026/CVE-2026-120421.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Mojarra","vendor":"Eclipse Foundation","versions":[{"lessThan":"4.0.29","status":"affected","version":"2.2.0","versionType":"semver"},{"lessThan":"4.1.20","status":"affected","version":"4.1.0","versionType":"semver"},{"lessThan":"5.0.0-M12","status":"affected","version":"5.0.0-M1","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy."}],"id":"CVE-2026-120421","lastModified":"2026-11-04T20:19:07.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120421","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:18:42.408189Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:41.590","references":[{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/536"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1332"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"emo@eclipse.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Mojarra","vendor":"Eclipse Foundation","versions":[{"lessThan":"4.0.29","status":"affected","version":"2.2.0","versionType":"semver"},{"lessThan":"4.1.20","status":"affected","version":"4.1.0","versionType":"semver"},{"lessThan":"5.0.0-M12","status":"affected","version":"5.0.0-M1","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy."}],"id":"CVE-2026-120421","lastModified":"2026-11-12T18:43:27.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120421","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:18:42.408189Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:41.590","references":[{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/536"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1332"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"emo@eclipse.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120466.json b/data/2026/CVE-2026-120466.json new file mode 100644 index 0000000000..e6f4c22469 --- /dev/null +++ b/data/2026/CVE-2026-120466.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site."}],"id":"CVE-2026-120466","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:18.017","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-120467.json b/data/2026/CVE-2026-120467.json new file mode 100644 index 0000000000..da7bf196ea --- /dev/null +++ b/data/2026/CVE-2026-120467.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site."}],"id":"CVE-2026-120467","lastModified":"2026-11-12T19:16:48.553","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T19:16:48.553","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-120468.json b/data/2026/CVE-2026-120468.json new file mode 100644 index 0000000000..5d0d085cc9 --- /dev/null +++ b/data/2026/CVE-2026-120468.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected."}],"id":"CVE-2026-120468","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:18.170","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-120469.json b/data/2026/CVE-2026-120469.json new file mode 100644 index 0000000000..82bdd1e65f --- /dev/null +++ b/data/2026/CVE-2026-120469.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain."}],"id":"CVE-2026-120469","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:18.330","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-120470.json b/data/2026/CVE-2026-120470.json new file mode 100644 index 0000000000..a703f9c455 --- /dev/null +++ b/data/2026/CVE-2026-120470.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience."}],"id":"CVE-2026-120470","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:18.490","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-120471.json b/data/2026/CVE-2026-120471.json new file mode 100644 index 0000000000..d2d3e35de5 --- /dev/null +++ b/data/2026/CVE-2026-120471.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected."}],"id":"CVE-2026-120471","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:18.633","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@joomla.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-120490.json b/data/2026/CVE-2026-120490.json index 4d1e1b46d2..4fa5b99c8f 100644 --- a/data/2026/CVE-2026-120490.json +++ b/data/2026/CVE-2026-120490.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Scalable Platforms (ElasticXL, Maestro, Chassis)","vendor":"checkpoint","versions":[{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"source":"cve@checkpoint.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges."}],"id":"CVE-2026-120490","lastModified":"2026-11-12T14:17:23.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"cve@checkpoint.com","type":"Secondary"}]},"published":"2026-11-12T14:17:23.770","references":[{"source":"cve@checkpoint.com","url":"https://support.checkpoint.com/results/sk/sk1000364"}],"sourceIdentifier":"cve@checkpoint.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"cve@checkpoint.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Scalable Platforms (ElasticXL, Maestro, Chassis)","vendor":"checkpoint","versions":[{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"source":"cve@checkpoint.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges."}],"id":"CVE-2026-120490","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"cve@checkpoint.com","type":"Secondary"}]},"published":"2026-11-12T14:17:23.770","references":[{"source":"cve@checkpoint.com","url":"https://support.checkpoint.com/results/sk/sk1000364"}],"sourceIdentifier":"cve@checkpoint.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"cve@checkpoint.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120513.json b/data/2026/CVE-2026-120513.json index 230c6f71fe..115ed6d898 100644 --- a/data/2026/CVE-2026-120513.json +++ b/data/2026/CVE-2026-120513.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","vendor":"wpeverest","versions":[{"lessThanOrEqual":"3.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the 'Disable storing entry information' setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances."}],"id":"CVE-2026-120513","lastModified":"2026-11-10T07:16:52.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-10T07:16:51.733","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/abstracts/class-evf-form-fields-upload.php#L1396"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/abstracts/class-evf-form-fields-upload.php#L1680"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/class-evf-ajax.php#L681"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/class-evf-form-task.php#L594"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3747723/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d61468b-8fda-4775-8099-a34ddf34566b?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@wordfence.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","vendor":"wpeverest","versions":[{"lessThanOrEqual":"3.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the 'Disable storing entry information' setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances."}],"id":"CVE-2026-120513","lastModified":"2026-11-12T19:16:48.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120513","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:41.741628Z","version":"2.0.3"}}]},"published":"2026-11-10T07:16:51.733","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/abstracts/class-evf-form-fields-upload.php#L1396"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/abstracts/class-evf-form-fields-upload.php#L1680"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/class-evf-ajax.php#L681"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.2/includes/class-evf-form-task.php#L594"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3747723/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d61468b-8fda-4775-8099-a34ddf34566b?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@wordfence.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12062.json b/data/2026/CVE-2026-12062.json index db471f40d5..8068c5f3bc 100644 --- a/data/2026/CVE-2026-12062.json +++ b/data/2026/CVE-2026-12062.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ADAudit Plus","vendor":"Zohocorp","versions":[{"lessThan":"8703","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API."}],"id":"CVE-2026-12062","lastModified":"2026-11-11T08:17:17.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-11T08:17:17.960","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/products/active-directory-audit/cve-2026-12062.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ADAudit Plus","vendor":"Zohocorp","versions":[{"lessThan":"8703","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API."}],"id":"CVE-2026-12062","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-11T08:17:17.960","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/products/active-directory-audit/cve-2026-12062.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120730.json b/data/2026/CVE-2026-120730.json index 361934a775..78e13adc21 100644 --- a/data/2026/CVE-2026-120730.json +++ b/data/2026/CVE-2026-120730.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.DeviceController'","'Elixir.NervesHub.Devices.Device'","'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Live.Devices.New'","'Elixir.NervesHubWeb.Live.Org.SigningKeys'","'Elixir.NervesHubWeb.Live.Products.New'","'Elixir.NervesHub.Devices.CACertificate.JITP'","'Elixir.NervesHub.ManagedDeployments'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/device_controller.ex","lib/nerves_hub/devices/device.ex","lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/live/devices/new.ex","lib/nerves_hub_web/live/org/signing_keys.ex","lib/nerves_hub_web/live/products/new.ex","lib/nerves_hub/devices/ca_certificate/jitp.ex","lib/nerves_hub/managed_deployments.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.DeviceController':create/2"},{"name":"'Elixir.NervesHubWeb.API.DeviceController':update/2"},{"name":"'Elixir.NervesHub.Devices.Device':changeset/2"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Devices.New':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Org.SigningKeys':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Products.New':handle_event/3"},{"name":"'Elixir.NervesHub.Devices.CACertificate.JITP':changeset/2"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.DeviceController'","'Elixir.NervesHub.Devices.Device'","'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Live.Devices.New'","'Elixir.NervesHubWeb.Live.Org.SigningKeys'","'Elixir.NervesHubWeb.Live.Products.New'","'Elixir.NervesHub.Devices.CACertificate.JITP'","'Elixir.NervesHub.ManagedDeployments'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/device_controller.ex","lib/nerves_hub/devices/device.ex","lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/live/devices/new.ex","lib/nerves_hub_web/live/org/signing_keys.ex","lib/nerves_hub_web/live/products/new.ex","lib/nerves_hub/devices/ca_certificate/jitp.ex","lib/nerves_hub/managed_deployments.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.DeviceController':create/2"},{"name":"'Elixir.NervesHubWeb.API.DeviceController':update/2"},{"name":"'Elixir.NervesHub.Devices.Device':changeset/2"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Devices.New':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Org.SigningKeys':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Products.New':handle_event/3"},{"name":"'Elixir.NervesHub.Devices.CACertificate.JITP':changeset/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.DeviceController'","'Elixir.NervesHub.Devices.Device'","'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Live.Devices.New'","'Elixir.NervesHubWeb.Live.Org.SigningKeys'","'Elixir.NervesHubWeb.Live.Products.New'","'Elixir.NervesHub.Devices.CACertificate.JITP'","'Elixir.NervesHub.ManagedDeployments'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/device_controller.ex","lib/nerves_hub/devices/device.ex","lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/live/devices/new.ex","lib/nerves_hub_web/live/org/signing_keys.ex","lib/nerves_hub_web/live/products/new.ex","lib/nerves_hub/devices/ca_certificate/jitp.ex","lib/nerves_hub/managed_deployments.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.DeviceController':create/2"},{"name":"'Elixir.NervesHubWeb.API.DeviceController':update/2"},{"name":"'Elixir.NervesHub.Devices.Device':changeset/2"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Devices.New':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Org.SigningKeys':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Products.New':handle_event/3"},{"name":"'Elixir.NervesHub.Devices.CACertificate.JITP':changeset/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"c367d7d17d07f843e78a70d15904665616dde964","status":"affected","version":"f58d58233dbd355c58d3a140107ece18e8863f14","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one.\n\nA device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."}],"id":"CVE-2026-120730","lastModified":"2026-11-11T20:17:06.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-10T11:16:42.230","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-120730.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/c367d7d17d07f843e78a70d15904665616dde964"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/f58d58233dbd355c58d3a140107ece18e8863f14"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-rpp7-x9hm-jrmr"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-120730"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-915"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.DeviceController'","'Elixir.NervesHub.Devices.Device'","'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Live.Devices.New'","'Elixir.NervesHubWeb.Live.Org.SigningKeys'","'Elixir.NervesHubWeb.Live.Products.New'","'Elixir.NervesHub.Devices.CACertificate.JITP'","'Elixir.NervesHub.ManagedDeployments'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/device_controller.ex","lib/nerves_hub/devices/device.ex","lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/live/devices/new.ex","lib/nerves_hub_web/live/org/signing_keys.ex","lib/nerves_hub_web/live/products/new.ex","lib/nerves_hub/devices/ca_certificate/jitp.ex","lib/nerves_hub/managed_deployments.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.DeviceController':create/2"},{"name":"'Elixir.NervesHubWeb.API.DeviceController':update/2"},{"name":"'Elixir.NervesHub.Devices.Device':changeset/2"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Devices.New':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Org.SigningKeys':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Products.New':handle_event/3"},{"name":"'Elixir.NervesHub.Devices.CACertificate.JITP':changeset/2"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.DeviceController'","'Elixir.NervesHub.Devices.Device'","'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Live.Devices.New'","'Elixir.NervesHubWeb.Live.Org.SigningKeys'","'Elixir.NervesHubWeb.Live.Products.New'","'Elixir.NervesHub.Devices.CACertificate.JITP'","'Elixir.NervesHub.ManagedDeployments'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/device_controller.ex","lib/nerves_hub/devices/device.ex","lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/live/devices/new.ex","lib/nerves_hub_web/live/org/signing_keys.ex","lib/nerves_hub_web/live/products/new.ex","lib/nerves_hub/devices/ca_certificate/jitp.ex","lib/nerves_hub/managed_deployments.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.DeviceController':create/2"},{"name":"'Elixir.NervesHubWeb.API.DeviceController':update/2"},{"name":"'Elixir.NervesHub.Devices.Device':changeset/2"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Devices.New':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Org.SigningKeys':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Products.New':handle_event/3"},{"name":"'Elixir.NervesHub.Devices.CACertificate.JITP':changeset/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.API.DeviceController'","'Elixir.NervesHub.Devices.Device'","'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'","'Elixir.NervesHubWeb.Live.Devices.New'","'Elixir.NervesHubWeb.Live.Org.SigningKeys'","'Elixir.NervesHubWeb.Live.Products.New'","'Elixir.NervesHub.Devices.CACertificate.JITP'","'Elixir.NervesHub.ManagedDeployments'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/controllers/api/device_controller.ex","lib/nerves_hub/devices/device.ex","lib/nerves_hub_web/components/device_page/settings_tab.ex","lib/nerves_hub_web/live/devices/new.ex","lib/nerves_hub_web/live/org/signing_keys.ex","lib/nerves_hub_web/live/products/new.ex","lib/nerves_hub/devices/ca_certificate/jitp.ex","lib/nerves_hub/managed_deployments.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.API.DeviceController':create/2"},{"name":"'Elixir.NervesHubWeb.API.DeviceController':update/2"},{"name":"'Elixir.NervesHub.Devices.Device':changeset/2"},{"name":"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Devices.New':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Org.SigningKeys':handle_event/3"},{"name":"'Elixir.NervesHubWeb.Live.Products.New':handle_event/3"},{"name":"'Elixir.NervesHub.Devices.CACertificate.JITP':changeset/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"c367d7d17d07f843e78a70d15904665616dde964","status":"affected","version":"f58d58233dbd355c58d3a140107ece18e8863f14","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one.\n\nA device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."}],"id":"CVE-2026-120730","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120730","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:46:09.344720Z","version":"2.0.3"}}]},"published":"2026-11-10T11:16:42.230","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-120730.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/c367d7d17d07f843e78a70d15904665616dde964"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/f58d58233dbd355c58d3a140107ece18e8863f14"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-rpp7-x9hm-jrmr"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-120730"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-rpp7-x9hm-jrmr"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-915"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120761.json b/data/2026/CVE-2026-120761.json index 5ffd040285..141c93b3f7 100644 --- a/data/2026/CVE-2026-120761.json +++ b/data/2026/CVE-2026-120761.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-kernel","packageURL":"pkg:maven/org.apache.axis2/axis2-kernel","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-120761","lastModified":"2026-11-12T16:18:48.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120761","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:30:31.626887Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:21.857","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1d3457d12399c7721ed3f52e7031d1d24d169460"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/7jw9v3qz0cdpon7fc6vsvkqp0jdt5kt0"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/22"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-kernel","packageURL":"pkg:maven/org.apache.axis2/axis2-kernel","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-120761","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120761","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:30:31.626887Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:21.857","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1d3457d12399c7721ed3f52e7031d1d24d169460"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/7jw9v3qz0cdpon7fc6vsvkqp0jdt5kt0"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/22"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120832.json b/data/2026/CVE-2026-120832.json index 42e9079055..bfb73b9a07 100644 --- a/data/2026/CVE-2026-120832.json +++ b/data/2026/CVE-2026-120832.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-kernel","packageURL":"pkg:maven/org.apache.axis2/axis2-kernel","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and xsd:include schemaLocations with no scheme or host restriction; the AAR and WAR deployment resolvers also passed absolute schema locations on to the network. An attacker who controls a WSDL or schema processed by an Axis2 application could therefore make the JVM send requests to arbitrary internal or external hosts. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-120832","lastModified":"2026-11-12T16:18:50.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120832","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:26:11.018652Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:21.990","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/7ac84d8339ad80f8f7f7977cf0caaa28fc3b7b98"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/bdf689rhvgg6rtlgqvvq8728f8pkj6zb"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/27"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-kernel","packageURL":"pkg:maven/org.apache.axis2/axis2-kernel","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and xsd:include schemaLocations with no scheme or host restriction; the AAR and WAR deployment resolvers also passed absolute schema locations on to the network. An attacker who controls a WSDL or schema processed by an Axis2 application could therefore make the JVM send requests to arbitrary internal or external hosts. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-120832","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120832","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:26:11.018652Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:21.990","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/7ac84d8339ad80f8f7f7977cf0caaa28fc3b7b98"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/bdf689rhvgg6rtlgqvvq8728f8pkj6zb"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/27"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120974.json b/data/2026/CVE-2026-120974.json index c9e57da48c..1ec08c0032 100644 --- a/data/2026/CVE-2026-120974.json +++ b/data/2026/CVE-2026-120974.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.28.0F","status":"affected","version":"4.27.0F","versionType":"custom"},{"lessThanOrEqual":"4.28.13M","status":"affected","version":"4.28.0F","versionType":"custom"},{"lessThan":"4.30.0F","status":"affected","version":"4.29.0F","versionType":"custom"},{"lessThan":"4.31.0F","status":"affected","version":"4.30.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.31.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.8M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic."}],"id":"CVE-2026-120974","lastModified":"2026-11-10T20:18:52.357","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:52.357","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25041-security-advisory-0219"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-294"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.28.0F","status":"affected","version":"4.27.0F","versionType":"custom"},{"lessThanOrEqual":"4.28.13M","status":"affected","version":"4.28.0F","versionType":"custom"},{"lessThan":"4.30.0F","status":"affected","version":"4.29.0F","versionType":"custom"},{"lessThan":"4.31.0F","status":"affected","version":"4.30.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.31.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.8M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic."}],"id":"CVE-2026-120974","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:52.357","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25041-security-advisory-0219"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-294"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120975.json b/data/2026/CVE-2026-120975.json index e1c5b5290c..aa8868f3c9 100644 --- a/data/2026/CVE-2026-120975.json +++ b/data/2026/CVE-2026-120975.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.1F","status":"affected","version":"4.36.1F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority (CA) certificate retrieval enabled, a malicious packet may cause the AutoCertMgmt process to be terminated unexpectedly. Managed X.509 certificates will not be renewed automatically and may eventually expire, potentially disrupting TLS-dependent services."}],"id":"CVE-2026-120975","lastModified":"2026-11-10T20:18:52.517","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":0.5,"impactScore":2.5,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:52.517","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25027-security-advisory-0205"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-197"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.1F","status":"affected","version":"4.36.1F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority (CA) certificate retrieval enabled, a malicious packet may cause the AutoCertMgmt process to be terminated unexpectedly. Managed X.509 certificates will not be renewed automatically and may eventually expire, potentially disrupting TLS-dependent services."}],"id":"CVE-2026-120975","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":0.5,"impactScore":2.5,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:52.517","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25027-security-advisory-0205"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-197"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120976.json b/data/2026/CVE-2026-120976.json index d4f2814634..2159cb4520 100644 --- a/data/2026/CVE-2026-120976.json +++ b/data/2026/CVE-2026-120976.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["7388-8D Series","7500R/R2 Series","7800/R3/R3A Series","722XPM and 720XPM Series","750X Series","7050X3/X4 Series","7170 Series","7289R3 Series","7500R3 Series","7800R4 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.32.0F","status":"affected","version":"4.22.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.9M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).\n\nAn attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.\n\nThe vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present."}],"id":"CVE-2026-120976","lastModified":"2026-11-10T20:18:52.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:52.660","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25038-security-advisory-0216"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["7388-8D Series","7500R/R2 Series","7800/R3/R3A Series","722XPM and 720XPM Series","750X Series","7050X3/X4 Series","7170 Series","7289R3 Series","7500R3 Series","7800R4 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.32.0F","status":"affected","version":"4.22.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.9M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).\n\nAn attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.\n\nThe vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present."}],"id":"CVE-2026-120976","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:52.660","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25038-security-advisory-0216"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120977.json b/data/2026/CVE-2026-120977.json index 61d32b6eb9..a14b59d47a 100644 --- a/data/2026/CVE-2026-120977.json +++ b/data/2026/CVE-2026-120977.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7700R4 Series","7800R3/R4 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.32.0F","status":"affected","version":"4.31.2F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.9M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges."}],"id":"CVE-2026-120977","lastModified":"2026-11-10T20:18:52.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:52.800","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7700R4 Series","7800R3/R4 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.32.0F","status":"affected","version":"4.31.2F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.9M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges."}],"id":"CVE-2026-120977","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:52.800","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120978.json b/data/2026/CVE-2026-120978.json index 5062cf810f..a4fe26a6c6 100644 --- a/data/2026/CVE-2026-120978.json +++ b/data/2026/CVE-2026-120978.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (DPS) consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart unexpectedly. An Arista Pathfinder deployment is not required."}],"id":"CVE-2026-120978","lastModified":"2026-11-10T20:18:52.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:52.940","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25033-security-advisory-0211"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (DPS) consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart unexpectedly. An Arista Pathfinder deployment is not required."}],"id":"CVE-2026-120978","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:52.940","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25033-security-advisory-0211"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120979.json b/data/2026/CVE-2026-120979.json index 57041de928..48d12c0b66 100644 --- a/data/2026/CVE-2026-120979.json +++ b/data/2026/CVE-2026-120979.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link State (BGP-LS) configured for Dynamic Path Selection (DPS). On affected platforms running Arista EOS with BGP-LS configured for DPS, an attacker who has established an authenticated BGP-LS session with the device can send a specially crafted BGP packet to cause incorrect WAN path selection and disrupt traffic forwarding."}],"id":"CVE-2026-120979","lastModified":"2026-11-10T20:18:53.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.073","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1289"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link State (BGP-LS) configured for Dynamic Path Selection (DPS). On affected platforms running Arista EOS with BGP-LS configured for DPS, an attacker who has established an authenticated BGP-LS session with the device can send a specially crafted BGP packet to cause incorrect WAN path selection and disrupt traffic forwarding."}],"id":"CVE-2026-120979","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.073","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1289"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120980.json b/data/2026/CVE-2026-120980.json index 50cdf4690c..1e8f1fe784 100644 --- a/data/2026/CVE-2026-120980.json +++ b/data/2026/CVE-2026-120980.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["7280R3 Series","7500R3 Series","7800R3 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly."}],"id":"CVE-2026-120980","lastModified":"2026-11-10T20:18:53.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.217","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["7280R3 Series","7500R3 Series","7800R3 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly."}],"id":"CVE-2026-120980","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.217","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120981.json b/data/2026/CVE-2026-120981.json index c25ff4bc01..9d56afd4f2 100644 --- a/data/2026/CVE-2026-120981.json +++ b/data/2026/CVE-2026-120981.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["7280R3 Series","7500R3 Series","7800R3 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE router can affect the route advertisements of VPLS pseudowires, causing a churn of the established routes with other legitimate BGP peers."}],"id":"CVE-2026-120981","lastModified":"2026-11-10T20:18:53.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.360","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["7280R3 Series","7500R3 Series","7800R3 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE router can affect the route advertisements of VPLS pseudowires, causing a churn of the established routes with other legitimate BGP peers."}],"id":"CVE-2026-120981","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.360","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120982.json b/data/2026/CVE-2026-120982.json index 30bdf13edf..a3111b0ce8 100644 --- a/data/2026/CVE-2026-120982.json +++ b/data/2026/CVE-2026-120982.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding."}],"id":"CVE-2026-120982","lastModified":"2026-11-10T20:18:53.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.507","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25029-security-advisory-0207"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding."}],"id":"CVE-2026-120982","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.507","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25029-security-advisory-0207"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120983.json b/data/2026/CVE-2026-120983.json index 9e1f2f6c66..2224bbfcaa 100644 --- a/data/2026/CVE-2026-120983.json +++ b/data/2026/CVE-2026-120983.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","7010TX Series","7320X Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7300X/X3 Series","7050X3/X4 Series","750X Series","7250 Series","7358X4 Series","7368X4 Series","7388X5 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.9M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU."}],"id":"CVE-2026-120983","lastModified":"2026-11-10T20:18:53.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.653","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25037-security-advisory-0215"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","7010TX Series","7320X Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7300X/X3 Series","7050X3/X4 Series","750X Series","7250 Series","7358X4 Series","7368X4 Series","7388X5 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.9M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU."}],"id":"CVE-2026-120983","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.653","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25037-security-advisory-0215"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120997.json b/data/2026/CVE-2026-120997.json index 212cea3377..444966831d 100644 --- a/data/2026/CVE-2026-120997.json +++ b/data/2026/CVE-2026-120997.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.UserSocket'","'Elixir.NervesHubWeb.UserConsoleChannel'","'Elixir.NervesHubWeb.UserLocalShellChannel'","'Elixir.NervesHubWeb.DeviceEventsStreamChannel'","'Elixir.NervesHubWeb.Auth'","'Elixir.NervesHub.Accounts'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/channels/user_socket.ex","lib/nerves_hub_web/channels/user_console_channel.ex","lib/nerves_hub_web/channels/user_local_shell_channel.ex","lib/nerves_hub_web/channels/device_events_stream_channel.ex","lib/nerves_hub_web/auth.ex","lib/nerves_hub/accounts.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.UserSocket':connect/2"},{"name":"'Elixir.NervesHubWeb.UserSocket':id/1"},{"name":"'Elixir.NervesHubWeb.UserConsoleChannel':join/3"},{"name":"'Elixir.NervesHubWeb.UserLocalShellChannel':join/3"},{"name":"'Elixir.NervesHubWeb.DeviceEventsStreamChannel':join/3"},{"name":"'Elixir.NervesHubWeb.Auth':on_mount/4"},{"name":"'Elixir.NervesHubWeb.Auth':log_out_user/1"},{"name":"'Elixir.NervesHub.Accounts':soft_delete_org_user/1"},{"name":"'Elixir.NervesHub.Accounts':change_org_user_role/2"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.UserSocket'","'Elixir.NervesHubWeb.UserConsoleChannel'","'Elixir.NervesHubWeb.UserLocalShellChannel'","'Elixir.NervesHubWeb.DeviceEventsStreamChannel'","'Elixir.NervesHubWeb.Auth'","'Elixir.NervesHub.Accounts'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/channels/user_socket.ex","lib/nerves_hub_web/channels/user_console_channel.ex","lib/nerves_hub_web/channels/user_local_shell_channel.ex","lib/nerves_hub_web/channels/device_events_stream_channel.ex","lib/nerves_hub_web/auth.ex","lib/nerves_hub/accounts.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.UserSocket':connect/2"},{"name":"'Elixir.NervesHubWeb.UserSocket':id/1"},{"name":"'Elixir.NervesHubWeb.UserConsoleChannel':join/3"},{"name":"'Elixir.NervesHubWeb.UserLocalShellChannel':join/3"},{"name":"'Elixir.NervesHubWeb.DeviceEventsStreamChannel':join/3"},{"name":"'Elixir.NervesHubWeb.Auth':on_mount/4"},{"name":"'Elixir.NervesHubWeb.Auth':log_out_user/1"},{"name":"'Elixir.NervesHub.Accounts':soft_delete_org_user/1"},{"name":"'Elixir.NervesHub.Accounts':change_org_user_role/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.UserSocket'","'Elixir.NervesHubWeb.UserConsoleChannel'","'Elixir.NervesHubWeb.UserLocalShellChannel'","'Elixir.NervesHubWeb.DeviceEventsStreamChannel'","'Elixir.NervesHubWeb.Auth'","'Elixir.NervesHub.Accounts'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/channels/user_socket.ex","lib/nerves_hub_web/channels/user_console_channel.ex","lib/nerves_hub_web/channels/user_local_shell_channel.ex","lib/nerves_hub_web/channels/device_events_stream_channel.ex","lib/nerves_hub_web/auth.ex","lib/nerves_hub/accounts.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.UserSocket':connect/2"},{"name":"'Elixir.NervesHubWeb.UserSocket':id/1"},{"name":"'Elixir.NervesHubWeb.UserConsoleChannel':join/3"},{"name":"'Elixir.NervesHubWeb.UserLocalShellChannel':join/3"},{"name":"'Elixir.NervesHubWeb.DeviceEventsStreamChannel':join/3"},{"name":"'Elixir.NervesHubWeb.Auth':on_mount/4"},{"name":"'Elixir.NervesHubWeb.Auth':log_out_user/1"},{"name":"'Elixir.NervesHub.Accounts':soft_delete_org_user/1"},{"name":"'Elixir.NervesHub.Accounts':change_org_user_role/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"a96497ddd4d24ab1847f7685e255bf96fd87b85b","status":"affected","version":"b5d2438677f79d10e91aeef20a7b5cd8cca0d63c","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.\n\nThe dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."}],"id":"CVE-2026-120997","lastModified":"2026-11-11T20:17:06.560","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-10T11:16:42.550","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-120997.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/a96497ddd4d24ab1847f7685e255bf96fd87b85b"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/b5d2438677f79d10e91aeef20a7b5cd8cca0d63c"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-c7jf-qcx9-xxf8"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-120997"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.UserSocket'","'Elixir.NervesHubWeb.UserConsoleChannel'","'Elixir.NervesHubWeb.UserLocalShellChannel'","'Elixir.NervesHubWeb.DeviceEventsStreamChannel'","'Elixir.NervesHubWeb.Auth'","'Elixir.NervesHub.Accounts'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/channels/user_socket.ex","lib/nerves_hub_web/channels/user_console_channel.ex","lib/nerves_hub_web/channels/user_local_shell_channel.ex","lib/nerves_hub_web/channels/device_events_stream_channel.ex","lib/nerves_hub_web/auth.ex","lib/nerves_hub/accounts.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.UserSocket':connect/2"},{"name":"'Elixir.NervesHubWeb.UserSocket':id/1"},{"name":"'Elixir.NervesHubWeb.UserConsoleChannel':join/3"},{"name":"'Elixir.NervesHubWeb.UserLocalShellChannel':join/3"},{"name":"'Elixir.NervesHubWeb.DeviceEventsStreamChannel':join/3"},{"name":"'Elixir.NervesHubWeb.Auth':on_mount/4"},{"name":"'Elixir.NervesHubWeb.Auth':log_out_user/1"},{"name":"'Elixir.NervesHub.Accounts':soft_delete_org_user/1"},{"name":"'Elixir.NervesHub.Accounts':change_org_user_role/2"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.UserSocket'","'Elixir.NervesHubWeb.UserConsoleChannel'","'Elixir.NervesHubWeb.UserLocalShellChannel'","'Elixir.NervesHubWeb.DeviceEventsStreamChannel'","'Elixir.NervesHubWeb.Auth'","'Elixir.NervesHub.Accounts'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/channels/user_socket.ex","lib/nerves_hub_web/channels/user_console_channel.ex","lib/nerves_hub_web/channels/user_local_shell_channel.ex","lib/nerves_hub_web/channels/device_events_stream_channel.ex","lib/nerves_hub_web/auth.ex","lib/nerves_hub/accounts.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.UserSocket':connect/2"},{"name":"'Elixir.NervesHubWeb.UserSocket':id/1"},{"name":"'Elixir.NervesHubWeb.UserConsoleChannel':join/3"},{"name":"'Elixir.NervesHubWeb.UserLocalShellChannel':join/3"},{"name":"'Elixir.NervesHubWeb.DeviceEventsStreamChannel':join/3"},{"name":"'Elixir.NervesHubWeb.Auth':on_mount/4"},{"name":"'Elixir.NervesHubWeb.Auth':log_out_user/1"},{"name":"'Elixir.NervesHub.Accounts':soft_delete_org_user/1"},{"name":"'Elixir.NervesHub.Accounts':change_org_user_role/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHubWeb.UserSocket'","'Elixir.NervesHubWeb.UserConsoleChannel'","'Elixir.NervesHubWeb.UserLocalShellChannel'","'Elixir.NervesHubWeb.DeviceEventsStreamChannel'","'Elixir.NervesHubWeb.Auth'","'Elixir.NervesHub.Accounts'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub_web/channels/user_socket.ex","lib/nerves_hub_web/channels/user_console_channel.ex","lib/nerves_hub_web/channels/user_local_shell_channel.ex","lib/nerves_hub_web/channels/device_events_stream_channel.ex","lib/nerves_hub_web/auth.ex","lib/nerves_hub/accounts.ex"],"programRoutines":[{"name":"'Elixir.NervesHubWeb.UserSocket':connect/2"},{"name":"'Elixir.NervesHubWeb.UserSocket':id/1"},{"name":"'Elixir.NervesHubWeb.UserConsoleChannel':join/3"},{"name":"'Elixir.NervesHubWeb.UserLocalShellChannel':join/3"},{"name":"'Elixir.NervesHubWeb.DeviceEventsStreamChannel':join/3"},{"name":"'Elixir.NervesHubWeb.Auth':on_mount/4"},{"name":"'Elixir.NervesHubWeb.Auth':log_out_user/1"},{"name":"'Elixir.NervesHub.Accounts':soft_delete_org_user/1"},{"name":"'Elixir.NervesHub.Accounts':change_org_user_role/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"a96497ddd4d24ab1847f7685e255bf96fd87b85b","status":"affected","version":"b5d2438677f79d10e91aeef20a7b5cd8cca0d63c","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.\n\nThe dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."}],"id":"CVE-2026-120997","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120997","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:46:56.169469Z","version":"2.0.3"}}]},"published":"2026-11-10T11:16:42.550","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-120997.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/a96497ddd4d24ab1847f7685e255bf96fd87b85b"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/b5d2438677f79d10e91aeef20a7b5cd8cca0d63c"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-c7jf-qcx9-xxf8"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-120997"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-c7jf-qcx9-xxf8"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-120999.json b/data/2026/CVE-2026-120999.json index 3959f6aed3..6d222fc4fd 100644 --- a/data/2026/CVE-2026-120999.json +++ b/data/2026/CVE-2026-120999.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHub.Accounts'","'Elixir.NervesHub.Accounts.User'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.Live.Account'","'Elixir.NervesHubWeb.AccountController'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub/accounts.ex","lib/nerves_hub/accounts/user.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/live/account.ex","lib/nerves_hub_web/controllers/account_controller.ex"],"programRoutines":[{"name":"'Elixir.NervesHub.Accounts':update_or_create_user_from_ueberauth/1"},{"name":"'Elixir.NervesHub.Accounts':authenticate/2"},{"name":"'Elixir.NervesHub.Accounts.User':oauth_changeset/3"},{"name":"'Elixir.NervesHubWeb.SessionController':confirm/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':auth/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':login/2"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"2.3.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHub.Accounts'","'Elixir.NervesHub.Accounts.User'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.Live.Account'","'Elixir.NervesHubWeb.AccountController'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub/accounts.ex","lib/nerves_hub/accounts/user.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/live/account.ex","lib/nerves_hub_web/controllers/account_controller.ex"],"programRoutines":[{"name":"'Elixir.NervesHub.Accounts':update_or_create_user_from_ueberauth/1"},{"name":"'Elixir.NervesHub.Accounts':authenticate/2"},{"name":"'Elixir.NervesHub.Accounts.User':oauth_changeset/3"},{"name":"'Elixir.NervesHubWeb.SessionController':confirm/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':auth/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':login/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"2.3.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHub.Accounts'","'Elixir.NervesHub.Accounts.User'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.Live.Account'","'Elixir.NervesHubWeb.AccountController'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub/accounts.ex","lib/nerves_hub/accounts/user.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/live/account.ex","lib/nerves_hub_web/controllers/account_controller.ex"],"programRoutines":[{"name":"'Elixir.NervesHub.Accounts':update_or_create_user_from_ueberauth/1"},{"name":"'Elixir.NervesHub.Accounts':authenticate/2"},{"name":"'Elixir.NervesHub.Accounts.User':oauth_changeset/3"},{"name":"'Elixir.NervesHubWeb.SessionController':confirm/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':auth/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':login/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"54dbf93c3bd323df08223a853c9afcf0b4dbf8e4","status":"affected","version":"74982672ab914bd6f37c3bc0e24a06e3474fa030","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Accounts.update_or_create_user_from_ueberauth/1 signs a Google user in to any account carrying the same email that is not yet linked to a Google account, links it and marks the email confirmed, without the account's owner ever having proved they own the address. NervesHubWeb.SessionController.confirm/2 likewise signs in whoever follows a confirmation link. An attacker registers the address from the sign-up form, changes their own account's email to it, or registers it as an organization admin from an invite link, and keeps the password; when the address's owner signs in with Google or follows the confirmation link, they land in that account.\n\nThe Google path also creates accounts with registrations closed and never checks Google's email_verified claim, and the API's password sign-in in NervesHubWeb.API.UserController issues tokens to accounts whose email was never confirmed. The attacker gains only what the victim is granted afterwards, and nothing on accounts whose owners never use either path.\n\nThis issue affects nerves_hub: from 2.3.0 before 2.5.3."}],"id":"CVE-2026-120999","lastModified":"2026-11-11T20:17:06.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-10T11:16:42.800","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-120999.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/54dbf93c3bd323df08223a853c9afcf0b4dbf8e4"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/74982672ab914bd6f37c3bc0e24a06e3474fa030"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-r92p-gg92-gmwm"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-120999"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-345"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://ghcr.io","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHub.Accounts'","'Elixir.NervesHub.Accounts.User'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.Live.Account'","'Elixir.NervesHubWeb.AccountController'"],"packageName":"nerves-hub/nerves-hub","packageURL":"pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub","product":"nerves_hub_web","programFiles":["lib/nerves_hub/accounts.ex","lib/nerves_hub/accounts/user.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/live/account.ex","lib/nerves_hub_web/controllers/account_controller.ex"],"programRoutines":[{"name":"'Elixir.NervesHub.Accounts':update_or_create_user_from_ueberauth/1"},{"name":"'Elixir.NervesHub.Accounts':authenticate/2"},{"name":"'Elixir.NervesHub.Accounts.User':oauth_changeset/3"},{"name":"'Elixir.NervesHubWeb.SessionController':confirm/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':auth/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':login/2"}],"vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"2.3.0","versionType":"other"}]},{"cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHub.Accounts'","'Elixir.NervesHub.Accounts.User'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.Live.Account'","'Elixir.NervesHubWeb.AccountController'"],"packageName":"nerves_hub","packageURL":"pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git","product":"nerves_hub_web","programFiles":["lib/nerves_hub/accounts.ex","lib/nerves_hub/accounts/user.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/live/account.ex","lib/nerves_hub_web/controllers/account_controller.ex"],"programRoutines":[{"name":"'Elixir.NervesHub.Accounts':update_or_create_user_from_ueberauth/1"},{"name":"'Elixir.NervesHub.Accounts':authenticate/2"},{"name":"'Elixir.NervesHub.Accounts.User':oauth_changeset/3"},{"name":"'Elixir.NervesHubWeb.SessionController':confirm/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':auth/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':login/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"2.5.3","status":"affected","version":"2.3.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.NervesHub.Accounts'","'Elixir.NervesHub.Accounts.User'","'Elixir.NervesHubWeb.SessionController'","'Elixir.NervesHubWeb.API.UserController'","'Elixir.NervesHubWeb.Live.Account'","'Elixir.NervesHubWeb.AccountController'"],"packageName":"nerves-hub/nerves_hub_web","packageURL":"pkg:github/nerves-hub/nerves_hub_web","product":"nerves_hub_web","programFiles":["lib/nerves_hub/accounts.ex","lib/nerves_hub/accounts/user.ex","lib/nerves_hub_web/controllers/session_controller.ex","lib/nerves_hub_web/controllers/api/user_controller.ex","lib/nerves_hub_web/live/account.ex","lib/nerves_hub_web/controllers/account_controller.ex"],"programRoutines":[{"name":"'Elixir.NervesHub.Accounts':update_or_create_user_from_ueberauth/1"},{"name":"'Elixir.NervesHub.Accounts':authenticate/2"},{"name":"'Elixir.NervesHub.Accounts.User':oauth_changeset/3"},{"name":"'Elixir.NervesHubWeb.SessionController':confirm/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':auth/2"},{"name":"'Elixir.NervesHubWeb.API.UserController':login/2"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","vendor":"nerves-hub","versions":[{"lessThan":"54dbf93c3bd323df08223a853c9afcf0b4dbf8e4","status":"affected","version":"74982672ab914bd6f37c3bc0e24a06e3474fa030","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Accounts.update_or_create_user_from_ueberauth/1 signs a Google user in to any account carrying the same email that is not yet linked to a Google account, links it and marks the email confirmed, without the account's owner ever having proved they own the address. NervesHubWeb.SessionController.confirm/2 likewise signs in whoever follows a confirmation link. An attacker registers the address from the sign-up form, changes their own account's email to it, or registers it as an organization admin from an invite link, and keeps the password; when the address's owner signs in with Google or follows the confirmation link, they land in that account.\n\nThe Google path also creates accounts with registrations closed and never checks Google's email_verified claim, and the API's password sign-in in NervesHubWeb.API.UserController issues tokens to accounts whose email was never confirmed. The attacker gains only what the victim is granted afterwards, and nothing on accounts whose owners never use either path.\n\nThis issue affects nerves_hub: from 2.3.0 before 2.5.3."}],"id":"CVE-2026-120999","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120999","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:44:16.500445Z","version":"2.0.3"}}]},"published":"2026-11-10T11:16:42.800","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-120999.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/54dbf93c3bd323df08223a853c9afcf0b4dbf8e4"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/commit/74982672ab914bd6f37c3bc0e24a06e3474fa030"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-r92p-gg92-gmwm"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-120999"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-r92p-gg92-gmwm"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-345"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121006.json b/data/2026/CVE-2026-121006.json index e270118585..a7985e2646 100644 --- a/data/2026/CVE-2026-121006.json +++ b/data/2026/CVE-2026-121006.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["HTTP::Body"],"packageName":"HTTP-Body","packageURL":"pkg:cpan/HTTP-Body","programFiles":["lib/HTTP/Body.pm"],"programRoutines":[{"name":"HTTP::Body::add"}],"repo":"https://github.com/libwww-perl/HTTP-Body","versions":[{"lessThan":"1.24_02","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer."}],"id":"CVE-2026-121006","lastModified":"2026-11-10T18:17:20.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121006","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:32:54.621629Z","version":"2.0.3"}}]},"published":"2026-11-06T08:17:19.827","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24_02/changes"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/8"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["HTTP::Body"],"packageName":"HTTP-Body","packageURL":"pkg:cpan/HTTP-Body","programFiles":["lib/HTTP/Body.pm"],"programRoutines":[{"name":"HTTP::Body::add"}],"repo":"https://github.com/libwww-perl/HTTP-Body","versions":[{"lessThan":"1.24_02","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer."}],"id":"CVE-2026-121006","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121006","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:32:54.621629Z","version":"2.0.3"}}]},"published":"2026-11-06T08:17:19.827","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24_02/changes"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/8"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121007.json b/data/2026/CVE-2026-121007.json index b48f375d6f..64de619095 100644 --- a/data/2026/CVE-2026-121007.json +++ b/data/2026/CVE-2026-121007.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["SQL::Abstract"],"packageName":"SQL-Abstract","packageURL":"pkg:cpan/SQL-Abstract","programFiles":["lib/SQL/Abstract.pm"],"programRoutines":[{"name":"SQL::Abstract::_expand_statement"},{"name":"SQL::Abstract::_expand_values"}],"repo":"https://github.com/dbsrgits/sql-abstract","versions":[{"lessThan":"2.000001_04","status":"affected","version":"1.90_01","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position.\n\nA nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected.\n\nAn application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection."}],"id":"CVE-2026-121007","lastModified":"2026-11-10T13:18:21.683","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121007","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:43:18.560396Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:41.733","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/dbsrgits/sql-abstract/commit/79fc34e874b4edb441154eccddb04c57d5c1c90e.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["SQL::Abstract"],"packageName":"SQL-Abstract","packageURL":"pkg:cpan/SQL-Abstract","programFiles":["lib/SQL/Abstract.pm"],"programRoutines":[{"name":"SQL::Abstract::_expand_statement"},{"name":"SQL::Abstract::_expand_values"}],"repo":"https://github.com/dbsrgits/sql-abstract","versions":[{"lessThan":"2.000001_04","status":"affected","version":"1.90_01","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position.\n\nA nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected.\n\nAn application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection."}],"id":"CVE-2026-121007","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121007","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:43:18.560396Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:41.733","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/dbsrgits/sql-abstract/commit/79fc34e874b4edb441154eccddb04c57d5c1c90e.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121008.json b/data/2026/CVE-2026-121008.json index 04752873ca..df7ad67dca 100644 --- a/data/2026/CVE-2026-121008.json +++ b/data/2026/CVE-2026-121008.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["SQL::Abstract::Tree"],"packageName":"SQL-Abstract","packageURL":"pkg:cpan/SQL-Abstract","programFiles":["lib/SQL/Abstract/Tree.pm"],"programRoutines":[{"name":"SQL::Abstract::Tree::format"},{"name":"SQL::Abstract::Tree::format_keyword"},{"name":"SQL::Abstract::Tree::fill_in_placeholder"}],"repo":"https://github.com/dbsrgits/sql-abstract","versions":[{"lessThan":"2.000001_04","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile.\n\nThe html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup.\n\nAn application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page."}],"id":"CVE-2026-121008","lastModified":"2026-11-10T14:17:14.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121008","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:20:44.658221Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:41.873","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/dbsrgits/sql-abstract/commit/85a75fcde3e09da5181dee07a4eccba76ad94305.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["SQL::Abstract::Tree"],"packageName":"SQL-Abstract","packageURL":"pkg:cpan/SQL-Abstract","programFiles":["lib/SQL/Abstract/Tree.pm"],"programRoutines":[{"name":"SQL::Abstract::Tree::format"},{"name":"SQL::Abstract::Tree::format_keyword"},{"name":"SQL::Abstract::Tree::fill_in_placeholder"}],"repo":"https://github.com/dbsrgits/sql-abstract","versions":[{"lessThan":"2.000001_04","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile.\n\nThe html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup.\n\nAn application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page."}],"id":"CVE-2026-121008","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121008","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:20:44.658221Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:41.873","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/dbsrgits/sql-abstract/commit/85a75fcde3e09da5181dee07a4eccba76ad94305.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121009.json b/data/2026/CVE-2026-121009.json index c3d3bc74cd..6ef9d430dc 100644 --- a/data/2026/CVE-2026-121009.json +++ b/data/2026/CVE-2026-121009.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["SQL::Abstract"],"packageName":"SQL-Abstract","packageURL":"pkg:cpan/SQL-Abstract","programFiles":["lib/SQL/Abstract.pm"],"programRoutines":[{"name":"SQL::Abstract::_expand_func"}],"repo":"https://github.com/dbsrgits/sql-abstract","versions":[{"lessThan":"2.000001_04","status":"affected","version":"1.90_01","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection."}],"id":"CVE-2026-121009","lastModified":"2026-11-10T13:18:21.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121009","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:49:32.294272Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:42.000","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["SQL::Abstract"],"packageName":"SQL-Abstract","packageURL":"pkg:cpan/SQL-Abstract","programFiles":["lib/SQL/Abstract.pm"],"programRoutines":[{"name":"SQL::Abstract::_expand_func"}],"repo":"https://github.com/dbsrgits/sql-abstract","versions":[{"lessThan":"2.000001_04","status":"affected","version":"1.90_01","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func.\n\ninjection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked.\n\nAn application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection."}],"id":"CVE-2026-121009","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121009","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:49:32.294272Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:42.000","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/dbsrgits/sql-abstract/commit/b6e7d991ac588b937e8943a5b28b6837ff276a51.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000001_04/changes"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121111.json b/data/2026/CVE-2026-121111.json index 75143aa4a8..292c020c97 100644 --- a/data/2026/CVE-2026-121111.json +++ b/data/2026/CVE-2026-121111.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"}],"id":"CVE-2026-121111","lastModified":"2026-11-09T20:18:08.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121111","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:09:48.313810Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:18.647","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/553249498"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"3D027DBD-0C99-494F-90E6-3AE1BB156A9A","versionEndExcluding":"157.0.8103.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)"}],"id":"CVE-2026-121111","lastModified":"2026-11-12T18:38:48.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121111","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:09:48.313810Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:18.647","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/553249498"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121115.json b/data/2026/CVE-2026-121115.json index 405c113ee2..57932c6d50 100644 --- a/data/2026/CVE-2026-121115.json +++ b/data/2026/CVE-2026-121115.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)"}],"id":"CVE-2026-121115","lastModified":"2026-11-10T14:17:15.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121115","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:09:20.470662Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:19.217","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/513426189"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"3D027DBD-0C99-494F-90E6-3AE1BB156A9A","versionEndExcluding":"157.0.8103.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)"}],"id":"CVE-2026-121115","lastModified":"2026-11-12T18:38:35.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121115","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:09:20.470662Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:19.217","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/513426189"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121167.json b/data/2026/CVE-2026-121167.json index 420fedca92..3cd56bd684 100644 --- a/data/2026/CVE-2026-121167.json +++ b/data/2026/CVE-2026-121167.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"id":"CVE-2026-121167","lastModified":"2026-11-09T22:18:31.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121167","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:25:55.573365Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:24.740","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/571960472"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"3D027DBD-0C99-494F-90E6-3AE1BB156A9A","versionEndExcluding":"157.0.8103.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"id":"CVE-2026-121167","lastModified":"2026-11-12T18:38:20.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121167","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:25:55.573365Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:24.740","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Vendor Advisory"],"url":"https://issues.chromium.org/issues/571960472"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121169.json b/data/2026/CVE-2026-121169.json index 795a50a5b5..c34cabda3d 100644 --- a/data/2026/CVE-2026-121169.json +++ b/data/2026/CVE-2026-121169.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)"}],"id":"CVE-2026-121169","lastModified":"2026-11-09T20:18:08.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:53:14.740511Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:25.047","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/569965757"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"3D027DBD-0C99-494F-90E6-3AE1BB156A9A","versionEndExcluding":"157.0.8103.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)"}],"id":"CVE-2026-121169","lastModified":"2026-11-12T18:37:48.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:53:14.740511Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:25.047","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","tags":["Exploit","Issue Tracking","Vendor Advisory"],"url":"https://issues.chromium.org/issues/569965757"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121227.json b/data/2026/CVE-2026-121227.json index 2a07475b2f..c61b217d9c 100644 --- a/data/2026/CVE-2026-121227.json +++ b/data/2026/CVE-2026-121227.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-121227","lastModified":"2026-11-09T20:18:09.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121227","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:28:45.681273Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:32.577","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576937680"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"3D027DBD-0C99-494F-90E6-3AE1BB156A9A","versionEndExcluding":"157.0.8103.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-121227","lastModified":"2026-11-12T18:36:57.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121227","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:28:45.681273Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:32.577","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/576937680"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121231.json b/data/2026/CVE-2026-121231.json index b870c5e4a2..c61e41ac5a 100644 --- a/data/2026/CVE-2026-121231.json +++ b/data/2026/CVE-2026-121231.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"id":"CVE-2026-121231","lastModified":"2026-11-10T15:17:15.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121231","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:44:04.894780Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:33.107","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/548943621"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"3D027DBD-0C99-494F-90E6-3AE1BB156A9A","versionEndExcluding":"157.0.8103.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"id":"CVE-2026-121231","lastModified":"2026-11-12T18:36:44.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121231","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:44:04.894780Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:33.107","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","tags":["Issue Tracking","Vendor Advisory"],"url":"https://issues.chromium.org/issues/548943621"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121237.json b/data/2026/CVE-2026-121237.json index 21aeec148f..575320ef57 100644 --- a/data/2026/CVE-2026-121237.json +++ b/data/2026/CVE-2026-121237.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"id":"CVE-2026-121237","lastModified":"2026-11-09T20:18:09.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121237","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:32:12.467284Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:33.897","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/503201581"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://issues.chromium.org/issues/503201581"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"3D027DBD-0C99-494F-90E6-3AE1BB156A9A","versionEndExcluding":"157.0.8103.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"}],"id":"CVE-2026-121237","lastModified":"2026-11-12T18:36:17.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121237","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:32:12.467284Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:33.897","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","tags":["Issue Tracking","Vendor Advisory","Exploit"],"url":"https://issues.chromium.org/issues/503201581"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking","Vendor Advisory","Exploit"],"url":"https://issues.chromium.org/issues/503201581"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121240.json b/data/2026/CVE-2026-121240.json index 37e41bb8e8..a3fd60cd2d 100644 --- a/data/2026/CVE-2026-121240.json +++ b/data/2026/CVE-2026-121240.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)"}],"id":"CVE-2026-121240","lastModified":"2026-11-09T20:18:09.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121240","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:46:59.421653Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:34.290","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/563181376"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"3D027DBD-0C99-494F-90E6-3AE1BB156A9A","versionEndExcluding":"157.0.8103.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)"}],"id":"CVE-2026-121240","lastModified":"2026-11-12T18:35:44.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121240","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:46:59.421653Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:34.290","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/563181376"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121248.json b/data/2026/CVE-2026-121248.json index 31b4fdb584..fc3656ce64 100644 --- a/data/2026/CVE-2026-121248.json +++ b/data/2026/CVE-2026-121248.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)"}],"id":"CVE-2026-121248","lastModified":"2026-11-10T15:17:15.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121248","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:37:37.338762Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:35.360","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/517435285"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://issues.chromium.org/issues/517435285"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"3D027DBD-0C99-494F-90E6-3AE1BB156A9A","versionEndExcluding":"157.0.8103.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)"}],"id":"CVE-2026-121248","lastModified":"2026-11-12T18:35:29.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121248","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:37:37.338762Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:35.360","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","tags":["Issue Tracking","Vendor Advisory","Exploit"],"url":"https://issues.chromium.org/issues/517435285"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking","Vendor Advisory","Exploit"],"url":"https://issues.chromium.org/issues/517435285"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121253.json b/data/2026/CVE-2026-121253.json index 79f8550cf6..0e6d468c38 100644 --- a/data/2026/CVE-2026-121253.json +++ b/data/2026/CVE-2026-121253.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low)"}],"id":"CVE-2026-121253","lastModified":"2026-11-09T22:18:31.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121253","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:17:03.568261Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:36.060","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/553265115"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.38","status":"affected","version":"157.0.8103.38","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"3D027DBD-0C99-494F-90E6-3AE1BB156A9A","versionEndExcluding":"157.0.8103.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low)"}],"id":"CVE-2026-121253","lastModified":"2026-11-12T18:34:27.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121253","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:17:03.568261Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:36.060","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/553265115"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121265.json b/data/2026/CVE-2026-121265.json index 05c4255ebc..e59429e10d 100644 --- a/data/2026/CVE-2026-121265.json +++ b/data/2026/CVE-2026-121265.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["SQL::Abstract"],"packageName":"SQL-Abstract","packageURL":"pkg:cpan/SQL-Abstract","programFiles":["lib/SQL/Abstract.pm"],"programRoutines":[{"name":"SQL::Abstract::_expand_insert_value"},{"name":"SQL::Abstract::_expand_update_set_values"},{"name":"SQL::Abstract::generate"},{"name":"SQL::Abstract::values"}],"repo":"https://github.com/dbsrgits/sql-abstract","versions":[{"lessThan":"2.000003","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update.\n\nWith the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. Its first element goes into the SQL text unescaped and the rest become bind values. A JSON array, or a repeated form field decoded as an arrayref, is such a value.\n\nAn application that passes request data as column values to insert or update with the default options allows SQL injection.\n\nReleases before 2.000003 also treat an arrayref in generate() as literal SQL, including through AUTOLOAD when allow_autoload is on, whatever array_datatypes is set to."}],"id":"CVE-2026-121265","lastModified":"2026-11-10T14:17:15.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121265","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:12:36.569233Z","version":"2.0.3"}}]},"published":"2026-11-07T12:17:44.973","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000003/changes"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000003/diff/GETTY/SQL-Abstract-2.000001_04"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/07/10"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["SQL::Abstract"],"packageName":"SQL-Abstract","packageURL":"pkg:cpan/SQL-Abstract","programFiles":["lib/SQL/Abstract.pm"],"programRoutines":[{"name":"SQL::Abstract::_expand_insert_value"},{"name":"SQL::Abstract::_expand_update_set_values"},{"name":"SQL::Abstract::generate"},{"name":"SQL::Abstract::values"}],"repo":"https://github.com/dbsrgits/sql-abstract","versions":[{"lessThan":"2.000003","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update.\n\nWith the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. Its first element goes into the SQL text unescaped and the rest become bind values. A JSON array, or a repeated form field decoded as an arrayref, is such a value.\n\nAn application that passes request data as column values to insert or update with the default options allows SQL injection.\n\nReleases before 2.000003 also treat an arrayref in generate() as literal SQL, including through AUTOLOAD when allow_autoload is on, whatever array_datatypes is set to."}],"id":"CVE-2026-121265","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121265","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:12:36.569233Z","version":"2.0.3"}}]},"published":"2026-11-07T12:17:44.973","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000003/changes"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GETTY/SQL-Abstract-2.000003/diff/GETTY/SQL-Abstract-2.000001_04"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/07/10"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121286.json b/data/2026/CVE-2026-121286.json index 4d5aa39a2c..a0612832b7 100644 --- a/data/2026/CVE-2026-121286.json +++ b/data/2026/CVE-2026-121286.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.22.1F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering (SR-TE) address family configured, a BGP peer can send crafted BGP packets to cause the BGP process to restart, disrupting all BGP sessions on the device."}],"id":"CVE-2026-121286","lastModified":"2026-11-10T20:18:53.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.800","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25035-security-advisory-0213"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.22.1F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering (SR-TE) address family configured, a BGP peer can send crafted BGP packets to cause the BGP process to restart, disrupting all BGP sessions on the device."}],"id":"CVE-2026-121286","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.800","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25035-security-advisory-0213"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121287.json b/data/2026/CVE-2026-121287.json index 5337064428..8505a55c11 100644 --- a/data/2026/CVE-2026-121287.json +++ b/data/2026/CVE-2026-121287.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device."}],"id":"CVE-2026-121287","lastModified":"2026-11-10T20:18:53.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.950","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-124"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device."}],"id":"CVE-2026-121287","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.950","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-124"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121288.json b/data/2026/CVE-2026-121288.json index c63e0dad69..ebccc71857 100644 --- a/data/2026/CVE-2026-121288.json +++ b/data/2026/CVE-2026-121288.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity."}],"id":"CVE-2026-121288","lastModified":"2026-11-10T20:18:54.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.130","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-303"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity."}],"id":"CVE-2026-121288","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.130","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-303"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121289.json b/data/2026/CVE-2026-121289.json index 1e0a89a197..f0d4bff144 100644 --- a/data/2026/CVE-2026-121289.json +++ b/data/2026/CVE-2026-121289.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.25.1F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.\n\nSuccessful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system."}],"id":"CVE-2026-121289","lastModified":"2026-11-10T20:18:54.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.283","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.25.1F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.\n\nSuccessful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system."}],"id":"CVE-2026-121289","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.283","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121290.json b/data/2026/CVE-2026-121290.json index d55d5de50e..33b2e7c16a 100644 --- a/data/2026/CVE-2026-121290.json +++ b/data/2026/CVE-2026-121290.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts."}],"id":"CVE-2026-121290","lastModified":"2026-11-10T20:18:54.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.447","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25031-security-advisory-0209"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-420"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts."}],"id":"CVE-2026-121290","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.447","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25031-security-advisory-0209"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-420"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121291.json b/data/2026/CVE-2026-121291.json index 762aa42869..606d562bab 100644 --- a/data/2026/CVE-2026-121291.json +++ b/data/2026/CVE-2026-121291.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates."}],"id":"CVE-2026-121291","lastModified":"2026-11-10T20:18:54.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.597","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates."}],"id":"CVE-2026-121291","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.597","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121292.json b/data/2026/CVE-2026-121292.json index 7dddebf077..79f6978cad 100644 --- a/data/2026/CVE-2026-121292.json +++ b/data/2026/CVE-2026-121292.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.24.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging."}],"id":"CVE-2026-121292","lastModified":"2026-11-10T20:18:54.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.743","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.24.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging."}],"id":"CVE-2026-121292","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.743","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121293.json b/data/2026/CVE-2026-121293.json index f36c09247e..afcdbc50a9 100644 --- a/data/2026/CVE-2026-121293.json +++ b/data/2026/CVE-2026-121293.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol (BGP) peer can send a crafted BGP message over an established session with the Dynamic Path Selection (DPS) address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessions and disrupting routing services until the process restarts."}],"id":"CVE-2026-121293","lastModified":"2026-11-10T20:18:55.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.293","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25032-security-advisory-0210"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol (BGP) peer can send a crafted BGP message over an established session with the Dynamic Path Selection (DPS) address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessions and disrupting routing services until the process restarts."}],"id":"CVE-2026-121293","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.293","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25032-security-advisory-0210"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121294.json b/data/2026/CVE-2026-121294.json index ec349d7ace..bd6acbc046 100644 --- a/data/2026/CVE-2026-121294.json +++ b/data/2026/CVE-2026-121294.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7280R/R2/R3/R4 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.29.0F","versionType":"custom"},{"lessThan":"4.29.0F","status":"affected","version":"4.28.2F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with a S-BFD reflector proxy configured, an unauthenticated attacker could send a crafted S-BFD Protocol Data Unit (PDU) that might cause the device to temporarily cease reflecting S-BFD packets, potentially resulting in S-BFD session timeouts."}],"id":"CVE-2026-121294","lastModified":"2026-11-10T20:18:55.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.547","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7280R/R2/R3/R4 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.29.0F","versionType":"custom"},{"lessThan":"4.29.0F","status":"affected","version":"4.28.2F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with a S-BFD reflector proxy configured, an unauthenticated attacker could send a crafted S-BFD Protocol Data Unit (PDU) that might cause the device to temporarily cease reflecting S-BFD packets, potentially resulting in S-BFD session timeouts."}],"id":"CVE-2026-121294","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.547","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121295.json b/data/2026/CVE-2026-121295.json index f09380ed09..b9048d9ff8 100644 --- a/data/2026/CVE-2026-121295.json +++ b/data/2026/CVE-2026-121295.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7280R/R2/R3/R4 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot."}],"id":"CVE-2026-121295","lastModified":"2026-11-10T20:18:55.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.750","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7280R/R2/R3/R4 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot."}],"id":"CVE-2026-121295","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.750","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121349.json b/data/2026/CVE-2026-121349.json index 8df954ad37..fadfd326cc 100644 --- a/data/2026/CVE-2026-121349.json +++ b/data/2026/CVE-2026-121349.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121349","lastModified":"2026-11-11T11:17:13.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121349","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:38.499712Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.643","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121349","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121349","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:38.499712Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.643","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121350.json b/data/2026/CVE-2026-121350.json index 2c1d0c7193..13576900c1 100644 --- a/data/2026/CVE-2026-121350.json +++ b/data/2026/CVE-2026-121350.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. A low-privileged attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121350","lastModified":"2026-11-12T16:18:50.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121350","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:10:41.129819Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.777","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. A low-privileged attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121350","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121350","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:10:41.129819Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.777","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121351.json b/data/2026/CVE-2026-121351.json index 5c7beb6b5a..cb45423ce4 100644 --- a/data/2026/CVE-2026-121351.json +++ b/data/2026/CVE-2026-121351.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121351","lastModified":"2026-11-11T11:17:13.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121351","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:21.071250Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.910","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121351","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121351","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:21.071250Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:24.910","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121352.json b/data/2026/CVE-2026-121352.json index d17e313b34..f032f4c599 100644 --- a/data/2026/CVE-2026-121352.json +++ b/data/2026/CVE-2026-121352.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121352","lastModified":"2026-11-11T11:17:13.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121352","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:25.965151Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:25.060","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121352","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121352","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:25.965151Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:25.060","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121353.json b/data/2026/CVE-2026-121353.json index 6fc18543ab..2272defe84 100644 --- a/data/2026/CVE-2026-121353.json +++ b/data/2026/CVE-2026-121353.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121353","lastModified":"2026-11-11T11:17:13.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121353","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:27.212922Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:25.217","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121353","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121353","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:27.212922Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:25.217","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121354.json b/data/2026/CVE-2026-121354.json index b424774d8f..c191756f92 100644 --- a/data/2026/CVE-2026-121354.json +++ b/data/2026/CVE-2026-121354.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121354","lastModified":"2026-11-11T11:17:14.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121354","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:28.386047Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:25.373","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121354","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121354","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:28.386047Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:25.373","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121355.json b/data/2026/CVE-2026-121355.json index 86dadcd722..e955bca01f 100644 --- a/data/2026/CVE-2026-121355.json +++ b/data/2026/CVE-2026-121355.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-121355","lastModified":"2026-11-12T16:18:50.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121355","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:09:03.741862Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:25.510","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-121355","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121355","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:09:03.741862Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:25.510","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121356.json b/data/2026/CVE-2026-121356.json index 015d4b32cc..e22eff790c 100644 --- a/data/2026/CVE-2026-121356.json +++ b/data/2026/CVE-2026-121356.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121356","lastModified":"2026-11-11T11:17:14.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121356","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:17.326745Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:25.637","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121356","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121356","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:17.326745Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:25.637","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121367.json b/data/2026/CVE-2026-121367.json index 76b686176b..debeaef63a 100644 --- a/data/2026/CVE-2026-121367.json +++ b/data/2026/CVE-2026-121367.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"status":"affected","version":"4.37.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication.\n\nSuccessful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device."}],"id":"CVE-2026-121367","lastModified":"2026-11-10T20:18:55.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.933","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25042-security-advisory-0220"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"status":"affected","version":"4.37.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication.\n\nSuccessful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device."}],"id":"CVE-2026-121367","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.933","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25042-security-advisory-0220"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121368.json b/data/2026/CVE-2026-121368.json index 697ffcb87a..eec022be60 100644 --- a/data/2026/CVE-2026-121368.json +++ b/data/2026/CVE-2026-121368.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot."}],"id":"CVE-2026-121368","lastModified":"2026-11-10T20:18:56.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:56.123","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot."}],"id":"CVE-2026-121368","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:56.123","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121369.json b/data/2026/CVE-2026-121369.json index a9632760be..b08d10f80f 100644 --- a/data/2026/CVE-2026-121369.json +++ b/data/2026/CVE-2026-121369.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["750X Series (CCS-750XM-48TX-LC, CCS-750XPM-48NH-LC, CCS-750XPM-48TXH-LC)"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.2F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1M","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot."}],"id":"CVE-2026-121369","lastModified":"2026-11-10T20:18:56.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:56.303","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25047-security-advisory-0225"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["750X Series (CCS-750XM-48TX-LC, CCS-750XPM-48NH-LC, CCS-750XPM-48TXH-LC)"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.2F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1M","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot."}],"id":"CVE-2026-121369","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:56.303","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25047-security-advisory-0225"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121370.json b/data/2026/CVE-2026-121370.json index 90b50aaa2b..1cf48d1e85 100644 --- a/data/2026/CVE-2026-121370.json +++ b/data/2026/CVE-2026-121370.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["750X Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.34.1F","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.8M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.31.0F","versionType":"custom"},{"lessThan":"4.31.0F","status":"affected","version":"4.30.0F","versionType":"custom"},{"lessThan":"4.30.0F","status":"affected","version":"4.29.2F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Precision Time Protocol (PTP) configured, an unauthenticated attacker with network access to a PTP-enabled port can create a denial of service (DoS) condition by sending traffic to the system."}],"id":"CVE-2026-121370","lastModified":"2026-11-10T22:18:25.777","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121370","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:23:15.251420Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:56.507","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25046-security-advisory-0224"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["750X Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.34.1F","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.8M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.31.0F","versionType":"custom"},{"lessThan":"4.31.0F","status":"affected","version":"4.30.0F","versionType":"custom"},{"lessThan":"4.30.0F","status":"affected","version":"4.29.2F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Precision Time Protocol (PTP) configured, an unauthenticated attacker with network access to a PTP-enabled port can create a denial of service (DoS) condition by sending traffic to the system."}],"id":"CVE-2026-121370","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121370","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:23:15.251420Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:56.507","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25046-security-advisory-0224"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121371.json b/data/2026/CVE-2026-121371.json index b61f7505bb..7efb0d6574 100644 --- a/data/2026/CVE-2026-121371.json +++ b/data/2026/CVE-2026-121371.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.3M","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.7M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.9M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.11M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem."}],"id":"CVE-2026-121371","lastModified":"2026-11-10T22:18:25.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121371","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:22:30.414859Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:56.640","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@arista.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.3M","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.7M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.9M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.11M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem."}],"id":"CVE-2026-121371","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121371","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:22:30.414859Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:56.640","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@arista.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121472.json b/data/2026/CVE-2026-121472.json index 6df7f10630..404fde75e1 100644 --- a/data/2026/CVE-2026-121472.json +++ b/data/2026/CVE-2026-121472.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AutomatorWP","vendor":"Unknown","versions":[{"lessThan":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier."}],"id":"CVE-2026-121472","lastModified":"2026-11-11T12:19:33.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121472","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:21:16.280462Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.443","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/b1746ba7-11a6-4946-8ed3-be19e570ad26/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AutomatorWP","vendor":"Unknown","versions":[{"lessThan":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the administrator who started them, allowing attackers to make a logged-in administrator replace the stored integration credentials with the attacker's own via a CSRF attack, diverting the data the site sends to those services into an account the attacker controls. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier."}],"id":"CVE-2026-121472","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121472","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:21:16.280462Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.443","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/b1746ba7-11a6-4946-8ed3-be19e570ad26/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121497.json b/data/2026/CVE-2026-121497.json index 10528e669f..015d44110a 100644 --- a/data/2026/CVE-2026-121497.json +++ b/data/2026/CVE-2026-121497.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AskAny","vendor":"Unknown","versions":[{"lessThan":"2.2.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled."}],"id":"CVE-2026-121497","lastModified":"2026-11-11T12:19:33.460","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121497","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:20:43.320430Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.570","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e6aed436-10c6-403b-8d1a-0cf42f3e5aeb/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AskAny","vendor":"Unknown","versions":[{"lessThan":"2.2.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled."}],"id":"CVE-2026-121497","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121497","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:20:43.320430Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.570","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e6aed436-10c6-403b-8d1a-0cf42f3e5aeb/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121498.json b/data/2026/CVE-2026-121498.json index d2cfd854d1..98a475deca 100644 --- a/data/2026/CVE-2026-121498.json +++ b/data/2026/CVE-2026-121498.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AskAny","vendor":"Unknown","versions":[{"lessThan":"2.2.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address, and to add messages to their conversation or overwrite their details."}],"id":"CVE-2026-121498","lastModified":"2026-11-12T12:18:20.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121498","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:22.948589Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:12.547","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/0347e870-93ff-48d3-b100-6cd9ec0535bb/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AskAny","vendor":"Unknown","versions":[{"lessThan":"2.2.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address, and to add messages to their conversation or overwrite their details."}],"id":"CVE-2026-121498","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121498","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:22.948589Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:12.547","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/0347e870-93ff-48d3-b100-6cd9ec0535bb/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121526.json b/data/2026/CVE-2026-121526.json index 7ae9536cf0..0abf31d212 100644 --- a/data/2026/CVE-2026-121526.json +++ b/data/2026/CVE-2026-121526.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"},{"lessThanOrEqual":"6.5.7","status":"affected","version":"6.5.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests."}],"id":"CVE-2026-121526","lastModified":"2026-11-12T16:18:50.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:28:22.641639Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:10.970","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-191"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"},{"lessThanOrEqual":"6.5.7","status":"affected","version":"6.5.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests."}],"id":"CVE-2026-121526","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:28:22.641639Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:10.970","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-191"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121527.json b/data/2026/CVE-2026-121527.json index cce2997a49..d7eb86bfda 100644 --- a/data/2026/CVE-2026-121527.json +++ b/data/2026/CVE-2026-121527.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:forticlientems:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientEMS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.3","versionType":"semver"},{"lessThanOrEqual":"7.4.1","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.15","status":"affected","version":"7.2.12","versionType":"semver"},{"lessThanOrEqual":"7.2.10","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access via CLI commands."}],"id":"CVE-2026-121527","lastModified":"2026-11-12T16:18:50.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:10:19.731784Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:11.113","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-192"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:forticlientems:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientEMS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.3","versionType":"semver"},{"lessThanOrEqual":"7.4.1","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.15","status":"affected","version":"7.2.12","versionType":"semver"},{"lessThanOrEqual":"7.2.10","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access via CLI commands."}],"id":"CVE-2026-121527","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:10:19.731784Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:11.113","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-192"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121528.json b/data/2026/CVE-2026-121528.json index 290fc02b40..13fb8e4981 100644 --- a/data/2026/CVE-2026-121528.json +++ b/data/2026/CVE-2026-121528.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.9","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"6.4.16","status":"affected","version":"6.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website."}],"id":"CVE-2026-121528","lastModified":"2026-11-11T22:17:11.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.250","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-193"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.9","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"6.4.16","status":"affected","version":"6.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website."}],"id":"CVE-2026-121528","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.250","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-193"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-121529.json b/data/2026/CVE-2026-121529.json index 8e1f6471ab..db6ac35fad 100644 --- a/data/2026/CVE-2026-121529.json +++ b/data/2026/CVE-2026-121529.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:forticlientmac:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientMac","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:forticlientwindows:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientWindows","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.14","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:forticlientwindowspam:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindowspam:7.2.14:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientWindowsPAM","vendor":"Fortinet","versions":[{"status":"affected","version":"7.4.7"},{"status":"affected","version":"7.2.14"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim."}],"id":"CVE-2026-121529","lastModified":"2026-11-10T21:19:03.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:32:32.554778Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:56.790","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-194"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:forticlientmac:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientmac:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientMac","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:forticlientwindows:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientWindows","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.14","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:forticlientwindowspam:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientwindowspam:7.2.14:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientWindowsPAM","vendor":"Fortinet","versions":[{"status":"affected","version":"7.4.7"},{"status":"affected","version":"7.2.14"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute unauthorized code or commands. Successful exploitation requires interaction with the victim."}],"id":"CVE-2026-121529","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:32:32.554778Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:56.790","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-194"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121530.json b/data/2026/CVE-2026-121530.json index 06dc6a8b94..4db0f45230 100644 --- a/data/2026/CVE-2026-121530.json +++ b/data/2026/CVE-2026-121530.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via an invalid token after entering a valid username and password"}],"id":"CVE-2026-121530","lastModified":"2026-11-11T05:19:30.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:18:56.927","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-195"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via an invalid token after entering a valid username and password"}],"id":"CVE-2026-121530","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:18:56.927","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-195"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121619.json b/data/2026/CVE-2026-121619.json new file mode 100644 index 0000000000..5c94ca236b --- /dev/null +++ b/data/2026/CVE-2026-121619.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://packagist.org/packages/symfony/framework-bundle","defaultStatus":"unaffected","modules":["Symfony\\Component\\HttpFoundation\\Request::setTrustedProxies"],"packageName":"symfony/framework-bundle","product":"symfony","repo":"https://github.com/symfony/framework-bundle","vendor":"sensiolabs","versions":[{"lessThan":"7.4.23","status":"affected","version":"7.1","versionType":"git"},{"lessThan":"8.1.11","status":"affected","version":"8.0.0","versionType":"git"}]},{"collectionURL":"https://packagist.org/packages/symfony/http-foundation","defaultStatus":"unaffected","modules":["Symfony\\Component\\HttpFoundation\\Request::setTrustedProxies"],"packageName":"symfony/http-foundation","product":"symfony","repo":"https://github.com/symfony/http-foundation","vendor":"sensiolabs","versions":[{"lessThan":"7.4.23","status":"affected","version":"7.2","versionType":"git"},{"lessThan":"8.1.11","status":"affected","version":"8.0.0","versionType":"git"}]}],"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Symfony FrameworkBundle framework.trusted_proxies option and the HttpFoundation Request::setTrustedProxies() method trust remote clients as reverse proxies when the private_ranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in Symfony FrameworkBundle versions 7.1 prior to 7.4.23 and 8.x prior to 8.1.11, and HttpFoundation versions 7.2 prior to 7.4.23 and 8.x prior to 8.1.11. The private_ranges and PRIVATE_SUBNETS keywords resolved to IpUtils::PRIVATE_SUBNETS, the deny list of NoPrivateNetworkHttpClient, which lists the private and special-purpose prefixes a server must not connect to. Since the fix for CVE-2026-48736 (7.4.13 and 8.0.13), this list also covers the IPv6 prefixes that embed an IPv4 address: IPv4-mapped (::ffff:0:0/96), IPv4-compatible (::/96), 6to4 (2002::/16), Teredo (2001::/32) and NAT64 (64:ff9b::/96). The IPv4-mapped entry has been in the list since the private_ranges shortcut was introduced, in 7.1 for framework.trusted_proxies and in 7.2 for Request::setTrustedProxies(). Over-blocking is safe for a deny list, but when the same entries are used as the allow list of trusted proxies, they trust remote clients. A client whose connection arrives with such a source address is treated as a reverse proxy, and the X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port and X-Forwarded-Prefix headers it sends are honoured. For example, with Request::setTrustedProxies(['private_ranges'], ...), a request with REMOTE_ADDR set to ::ffff:203.0.113.7 and the headers X-Forwarded-For: 10.0.0.9, X-Forwarded-Host: evil.example.com and X-Forwarded-Proto: https makes getClientIp() return 10.0.0.9, getHost() return evil.example.com and isSecure() return true. Two kinds of deployments are exposed: a server listening on the IPv6 wildcard address without IPV6_V6ONLY reports every IPv4 client in the IPv4-mapped form, so every client is trusted, and a server reachable over IPv6 trusts any client sourcing from 6to4 or Teredo space, which is globally routed, whatever its listener. A spoofed client address defeats IP allow lists, rate limiting and audit logs; a spoofed host poisons the URLs written into password reset and login link e-mails and into shared caches; a spoofed scheme satisfies requires_channel: https over plain HTTP. Symfony 6.4 does not point any trusted proxy setting at IpUtils::PRIVATE_SUBNETS and is not affected by default, but an application that passes that constant to Request::setTrustedProxies() itself could be exposed in the same way on any version. This issue is fixed in 7.4.23 and 8.1.11."}],"id":"CVE-2026-121619","lastModified":"2026-11-12T19:16:49.030","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]},"published":"2026-11-12T19:16:48.840","references":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","url":"https://github.com/symfony/symfony/commit/e109aa54d42678e2a72ec148092a8453a67de931"},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","url":"https://github.com/symfony/symfony/security/advisories/GHSA-xg2q-4rrq-657q"}],"sourceIdentifier":"596c5446-0ce5-4ba2-aa66-48b3b757a647","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"},{"lang":"en","value":"CWE-348"}],"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121632.json b/data/2026/CVE-2026-121632.json index 64262009d2..a00b90c126 100644 --- a/data/2026/CVE-2026-121632.json +++ b/data/2026/CVE-2026-121632.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Data::MuForm"],"packageName":"Data-MuForm","packageURL":"pkg:cpan/Data-MuForm","programFiles":["lib/Data/MuForm/Renderer/Base.pm"],"programRoutines":[{"name":"Data::MuForm::Renderer::Base::process_attrs"},{"name":"Data::MuForm::Renderer::Base::render_select"},{"name":"Data::MuForm::Renderer::Base::render_select_option"},{"name":"Data::MuForm::Renderer::Base::render_radio_option"},{"name":"Data::MuForm::Renderer::Base::render_radio_label"},{"name":"Data::MuForm::Renderer::Base::render_checkbox_option"},{"name":"Data::MuForm::Renderer::Base::render_checkbox_label"}],"repo":"https://github.com/gshank/data-muform","versions":[{"lessThanOrEqual":"0.05","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping.\n\nprocess_attrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option's value becomes an unescaped attribute. Option and option group labels are also unescaped, the group label inside a label attribute and the others in element content.\n\nAny application whose option list is built from data rather than literals, using an options_ method, a build_options method or a DBIC model, allows attacker-influenced text in an option value or label that can embed JavaScript in rendered pages. Attribute values built from data, such as through element_attr, are affected the same way."}],"id":"CVE-2026-121632","lastModified":"2026-11-10T13:18:22.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121632","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:38:42.589807Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:42.130","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/gshank/data-muform/pull/18"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GSHANK/Data-MuForm-0.05/source/lib/Data/MuForm/Renderer/Base.pm#L202-228"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/04/4"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Data::MuForm"],"packageName":"Data-MuForm","packageURL":"pkg:cpan/Data-MuForm","programFiles":["lib/Data/MuForm/Renderer/Base.pm"],"programRoutines":[{"name":"Data::MuForm::Renderer::Base::process_attrs"},{"name":"Data::MuForm::Renderer::Base::render_select"},{"name":"Data::MuForm::Renderer::Base::render_select_option"},{"name":"Data::MuForm::Renderer::Base::render_radio_option"},{"name":"Data::MuForm::Renderer::Base::render_radio_label"},{"name":"Data::MuForm::Renderer::Base::render_checkbox_option"},{"name":"Data::MuForm::Renderer::Base::render_checkbox_label"}],"repo":"https://github.com/gshank/data-muform","versions":[{"lessThanOrEqual":"0.05","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping.\n\nprocess_attrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option's value becomes an unescaped attribute. Option and option group labels are also unescaped, the group label inside a label attribute and the others in element content.\n\nAny application whose option list is built from data rather than literals, using an options_ method, a build_options method or a DBIC model, allows attacker-influenced text in an option value or label that can embed JavaScript in rendered pages. Attribute values built from data, such as through element_attr, are affected the same way."}],"id":"CVE-2026-121632","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121632","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:38:42.589807Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:42.130","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/gshank/data-muform/pull/18"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/GSHANK/Data-MuForm-0.05/source/lib/Data/MuForm/Renderer/Base.pm#L202-228"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/04/4"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121653.json b/data/2026/CVE-2026-121653.json index b2a4f2d8a1..5c17f4712a 100644 --- a/data/2026/CVE-2026-121653.json +++ b/data/2026/CVE-2026-121653.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager","vendor":"ivanti","versions":[{"status":"unaffected","version":"2024 SU8"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution."}],"id":"CVE-2026-121653","lastModified":"2026-11-11T11:17:14.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121653","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:11.668007Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:17.580","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November-2026?language=en_US"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager","vendor":"ivanti","versions":[{"status":"unaffected","version":"2024 SU8"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution."}],"id":"CVE-2026-121653","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121653","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:11.668007Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:17.580","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November-2026?language=en_US"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121683.json b/data/2026/CVE-2026-121683.json index 6467eb192f..98ef608fb5 100644 --- a/data/2026/CVE-2026-121683.json +++ b/data/2026/CVE-2026-121683.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Cloud Services Application","vendor":"Ivanti","versions":[{"status":"unaffected","version":"5.0.8"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries."}],"id":"CVE-2026-121683","lastModified":"2026-11-10T16:17:17.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:17.900","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-CVE-2026-121683?language=en_US"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Cloud Services Application","vendor":"Ivanti","versions":[{"status":"unaffected","version":"5.0.8"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries."}],"id":"CVE-2026-121683","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:17.900","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-CVE-2026-121683?language=en_US"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Primary"}]} diff --git a/data/2026/CVE-2026-121685.json b/data/2026/CVE-2026-121685.json index 75d38c5c57..2670b96cfb 100644 --- a/data/2026/CVE-2026-121685.json +++ b/data/2026/CVE-2026-121685.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges."}],"id":"CVE-2026-121685","lastModified":"2026-11-09T17:17:16.680","metrics":{},"published":"2026-11-09T17:17:16.680","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges."}],"id":"CVE-2026-121685","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121685","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:48:49.678686Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:16.680","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121686.json b/data/2026/CVE-2026-121686.json index fa514855c9..751b6abe4e 100644 --- a/data/2026/CVE-2026-121686.json +++ b/data/2026/CVE-2026-121686.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet."}],"id":"CVE-2026-121686","lastModified":"2026-11-09T17:17:16.797","metrics":{},"published":"2026-11-09T17:17:16.797","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet."}],"id":"CVE-2026-121686","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121686","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:50:09.162760Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:16.797","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121687.json b/data/2026/CVE-2026-121687.json index e2875c41ed..0f7203cb2d 100644 --- a/data/2026/CVE-2026-121687.json +++ b/data/2026/CVE-2026-121687.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication.\r\n1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export.\r\n2. ADB (Android Debug Bridge, port 5555) access to root shell\r\n3. SSH (port 22)"}],"id":"CVE-2026-121687","lastModified":"2026-11-09T17:17:16.900","metrics":{},"published":"2026-11-09T17:17:16.900","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication.\r\n1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export.\r\n2. ADB (Android Debug Bridge, port 5555) access to root shell\r\n3. SSH (port 22)"}],"id":"CVE-2026-121687","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121687","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:53:15.574843Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:16.900","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121688.json b/data/2026/CVE-2026-121688.json index b792fb089e..a089e5d899 100644 --- a/data/2026/CVE-2026-121688.json +++ b/data/2026/CVE-2026-121688.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code."}],"id":"CVE-2026-121688","lastModified":"2026-11-09T17:17:17.000","metrics":{},"published":"2026-11-09T17:17:17.000","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code."}],"id":"CVE-2026-121688","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121688","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:54:54.914760Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:17.000","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-494"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121689.json b/data/2026/CVE-2026-121689.json index 464f2fe632..d7ea47b92d 100644 --- a/data/2026/CVE-2026-121689.json +++ b/data/2026/CVE-2026-121689.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file."}],"id":"CVE-2026-121689","lastModified":"2026-11-09T17:17:17.120","metrics":{},"published":"2026-11-09T17:17:17.120","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic exports. Additionally, unauthenticated ADB access allows retrieval of the /etc/shadow file."}],"id":"CVE-2026-121689","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121689","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:55:55.437322Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:17.120","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-121690.json b/data/2026/CVE-2026-121690.json index f12119b12a..7a65fe73d0 100644 --- a/data/2026/CVE-2026-121690.json +++ b/data/2026/CVE-2026-121690.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of the device."}],"id":"CVE-2026-121690","lastModified":"2026-11-09T17:17:17.230","metrics":{},"published":"2026-11-09T17:17:17.230","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"FrodoBots EarthRover Mini+ firmware","vendor":"FrodoBots","versions":[{"status":"affected","version":"6.2.4_6.2.5_0.614.0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of the device."}],"id":"CVE-2026-121690","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:59:55.095222Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:17.230","references":[{"source":"cret@cert.org","url":"https://github.com/frodobots-org"},{"source":"cret@cert.org","url":"https://kb.cert.org/vuls/id/188754"},{"source":"cret@cert.org","url":"https://www.frodobots.ai/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121741.json b/data/2026/CVE-2026-121741.json index 32f057259d..c2f5338eef 100644 --- a/data/2026/CVE-2026-121741.json +++ b/data/2026/CVE-2026-121741.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"SketchUp","vendor":"Trimble","versions":[{"status":"affected","version":"26.1.252"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30421."}],"id":"CVE-2026-121741","lastModified":"2026-11-12T03:17:10.323","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:10.323","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-893/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"SketchUp","vendor":"Trimble","versions":[{"status":"affected","version":"26.1.252"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30421."}],"id":"CVE-2026-121741","lastModified":"2026-11-12T18:48:46.580","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:10.323","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-893/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-121841.json b/data/2026/CVE-2026-121841.json index d572080507..9ac37df94d 100644 --- a/data/2026/CVE-2026-121841.json +++ b/data/2026/CVE-2026-121841.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Firefox for iOS","vendor":"Mozilla","versions":[{"lessThanOrEqual":"*","status":"unaffected","version":"160.0","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Other issue in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0."}],"id":"CVE-2026-121841","lastModified":"2026-11-10T16:27:13.943","metrics":{},"published":"2026-11-09T14:17:08.267","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2081874"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-124/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"product":"Firefox for iOS","vendor":"Mozilla","versions":[{"lessThanOrEqual":"*","status":"unaffected","version":"160.0","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Other issue in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0."}],"id":"CVE-2026-121841","lastModified":"2026-11-12T17:17:28.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121841","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:17.170739Z","version":"2.0.3"}}]},"published":"2026-11-09T14:17:08.267","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2081874"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-124/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-121862.json b/data/2026/CVE-2026-121862.json index 4744ca058d..7b4e3b4631 100644 --- a/data/2026/CVE-2026-121862.json +++ b/data/2026/CVE-2026-121862.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Knowledge Building","vendor":"Unknown","versions":[{"lessThan":"0.7.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators."}],"id":"CVE-2026-121862","lastModified":"2026-11-11T12:19:35.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121862","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:20:27.532196Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.710","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/2656cb05-7d95-4e82-acb4-ee62a31715f8/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Knowledge Building","vendor":"Unknown","versions":[{"lessThan":"0.7.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators."}],"id":"CVE-2026-121862","lastModified":"2026-11-12T18:44:50.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121862","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:20:27.532196Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.710","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/2656cb05-7d95-4e82-acb4-ee62a31715f8/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121863.json b/data/2026/CVE-2026-121863.json index 1a6591d429..b5ac807305 100644 --- a/data/2026/CVE-2026-121863.json +++ b/data/2026/CVE-2026-121863.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Knowledge Building","vendor":"Unknown","versions":[{"lessThan":"0.7.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Site Scripting."}],"id":"CVE-2026-121863","lastModified":"2026-11-11T12:19:35.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121863","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:20:14.178968Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.877","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/80b4b9d0-e48b-4f24-b4bd-71dc37ac1602/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Knowledge Building","vendor":"Unknown","versions":[{"lessThan":"0.7.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Site Scripting."}],"id":"CVE-2026-121863","lastModified":"2026-11-12T18:44:50.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121863","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:20:14.178968Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:16.877","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/80b4b9d0-e48b-4f24-b4bd-71dc37ac1602/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121870.json b/data/2026/CVE-2026-121870.json index 03cb5fd0df..fa0cc194f4 100644 --- a/data/2026/CVE-2026-121870.json +++ b/data/2026/CVE-2026-121870.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Simpler Checkout","vendor":"Unknown","versions":[{"lessThan":"1.5.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator."}],"id":"CVE-2026-121870","lastModified":"2026-11-11T12:19:35.927","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:20:00.501691Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.020","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/a07c97a1-0faf-43fa-a4c7-0f09937790eb/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Simpler Checkout","vendor":"Unknown","versions":[{"lessThan":"1.5.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator."}],"id":"CVE-2026-121870","lastModified":"2026-11-12T18:44:50.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:20:00.501691Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.020","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/a07c97a1-0faf-43fa-a4c7-0f09937790eb/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121873.json b/data/2026/CVE-2026-121873.json index 35eff00209..28377e7422 100644 --- a/data/2026/CVE-2026-121873.json +++ b/data/2026/CVE-2026-121873.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Redirection for Contact Form 7","vendor":"Unknown","versions":[{"lessThan":"3.2.16","status":"affected","version":"2.6.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control."}],"id":"CVE-2026-121873","lastModified":"2026-11-11T12:19:36.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121873","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:19:47.984392Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.140","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/543fa273-943b-40f6-bcdf-84ca800fa46b/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Redirection for Contact Form 7","vendor":"Unknown","versions":[{"lessThan":"3.2.16","status":"affected","version":"2.6.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control."}],"id":"CVE-2026-121873","lastModified":"2026-11-12T18:44:50.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121873","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:19:47.984392Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.140","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/543fa273-943b-40f6-bcdf-84ca800fa46b/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121876.json b/data/2026/CVE-2026-121876.json new file mode 100644 index 0000000000..382e11e870 --- /dev/null +++ b/data/2026/CVE-2026-121876.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the interaction between systemd-gpt-auto-generator and \nconfidential computing guest VM images in OpenShift Sandboxed Containers \n(confidential peer pods). systemd-gpt-auto-generator automatically discovers \nand mounts GPT partitions by type GUID at boot with no user confirmation. In \nthe confidential computing threat model, where the host/hypervisor is the \nadversary, a malicious host can inject partitions into the guest's virtual \ndisk. Most critically, injecting a swap partition causes the guest kernel to \npage out TEE-encrypted memory to a host-controlled block device, breaking the \nconfidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX).\n\nThe PodVM images use a GPT-partitioned disk with dm-verity on the root \npartition. However, the roothash= kernel parameter only disables root \nauto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are \nstill auto-discovered and mounted. The generator is shipped unmasked in the \nRHEL systemd-udev subpackage, and no kernel command line parameter in the \nmeasured UKI addon disables it. Additionally, the PodVM measurement script \ncaptures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so \npartition table modifications are not detected by remote attestation."}],"id":"CVE-2026-121876","lastModified":"2026-11-12T17:17:29.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.5,"impactScore":5.8,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T17:17:29.040","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-121876"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558210"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-359"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-121887.json b/data/2026/CVE-2026-121887.json index a1f74bf235..e35d9c5a25 100644 --- a/data/2026/CVE-2026-121887.json +++ b/data/2026/CVE-2026-121887.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121887","lastModified":"2026-11-11T11:17:14.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121887","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:29.579020Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.060","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121887","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121887","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:29.579020Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.060","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121889.json b/data/2026/CVE-2026-121889.json index fa24b246ed..c42faf59b3 100644 --- a/data/2026/CVE-2026-121889.json +++ b/data/2026/CVE-2026-121889.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121889","lastModified":"2026-11-11T11:17:14.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121889","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:19.752031Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.180","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121889","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121889","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:19.752031Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.180","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121890.json b/data/2026/CVE-2026-121890.json index 903187100f..0270018913 100644 --- a/data/2026/CVE-2026-121890.json +++ b/data/2026/CVE-2026-121890.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121890","lastModified":"2026-11-10T22:18:26.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:26.350","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121890","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:26.350","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"psirt@adobe.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-121892.json b/data/2026/CVE-2026-121892.json index ae7fd4d626..66ada2ed3b 100644 --- a/data/2026/CVE-2026-121892.json +++ b/data/2026/CVE-2026-121892.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121892","lastModified":"2026-11-11T11:17:14.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121892","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:30.796814Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.520","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121892","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121892","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:30.796814Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.520","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121894.json b/data/2026/CVE-2026-121894.json index 42ea66d9fe..d0c6dea333 100644 --- a/data/2026/CVE-2026-121894.json +++ b/data/2026/CVE-2026-121894.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121894","lastModified":"2026-11-11T11:17:15.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121894","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:32.009641Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.650","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121894","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121894","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:32.009641Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.650","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121896.json b/data/2026/CVE-2026-121896.json index c4c84e8ec7..b486a169dd 100644 --- a/data/2026/CVE-2026-121896.json +++ b/data/2026/CVE-2026-121896.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121896","lastModified":"2026-11-11T11:17:15.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121896","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:33.242833Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.773","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121896","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121896","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:33.242833Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.773","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121898.json b/data/2026/CVE-2026-121898.json index 7a1b4da24f..2aed788dc4 100644 --- a/data/2026/CVE-2026-121898.json +++ b/data/2026/CVE-2026-121898.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121898","lastModified":"2026-11-11T11:17:15.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121898","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:34.576818Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.897","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121898","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121898","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:34.576818Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.897","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121900.json b/data/2026/CVE-2026-121900.json index 89a5464302..128a4fda7d 100644 --- a/data/2026/CVE-2026-121900.json +++ b/data/2026/CVE-2026-121900.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-121900","lastModified":"2026-11-11T11:17:15.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121900","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:39.669222Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.020","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-121900","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121900","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:39.669222Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.020","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121902.json b/data/2026/CVE-2026-121902.json index 15961c410d..d25d55f0de 100644 --- a/data/2026/CVE-2026-121902.json +++ b/data/2026/CVE-2026-121902.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the application. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-121902","lastModified":"2026-11-11T11:17:15.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121902","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:40.806200Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.143","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the application. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-121902","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121902","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:40.806200Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.143","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121904.json b/data/2026/CVE-2026-121904.json index 10a2820463..d5fc32626b 100644 --- a/data/2026/CVE-2026-121904.json +++ b/data/2026/CVE-2026-121904.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed."}],"id":"CVE-2026-121904","lastModified":"2026-11-10T22:18:27.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:27.280","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed."}],"id":"CVE-2026-121904","lastModified":"2026-11-12T18:17:19.677","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121904","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:31:00.715141Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.280","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121906.json b/data/2026/CVE-2026-121906.json index 11bc92ade9..4462f750d6 100644 --- a/data/2026/CVE-2026-121906.json +++ b/data/2026/CVE-2026-121906.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121906","lastModified":"2026-11-11T11:17:15.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121906","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:36.931166Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.400","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121906","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121906","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:36.931166Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.400","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121908.json b/data/2026/CVE-2026-121908.json index dc00008cca..83157d1f6b 100644 --- a/data/2026/CVE-2026-121908.json +++ b/data/2026/CVE-2026-121908.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121908","lastModified":"2026-11-11T11:17:15.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121908","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:35.757925Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.533","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121908","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121908","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:35.757925Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.533","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121910.json b/data/2026/CVE-2026-121910.json index 824bade55d..5e25fd84b8 100644 --- a/data/2026/CVE-2026-121910.json +++ b/data/2026/CVE-2026-121910.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed."}],"id":"CVE-2026-121910","lastModified":"2026-11-10T22:18:27.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:27.663","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed."}],"id":"CVE-2026-121910","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:27.663","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-121912.json b/data/2026/CVE-2026-121912.json index 53fc87a7b7..ad96502048 100644 --- a/data/2026/CVE-2026-121912.json +++ b/data/2026/CVE-2026-121912.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}],"id":"CVE-2026-121912","lastModified":"2026-11-12T16:18:52.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121912","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:11:54.955611Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.783","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}],"id":"CVE-2026-121912","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121912","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:11:54.955611Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.783","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121913.json b/data/2026/CVE-2026-121913.json index 429e509204..9a427ad062 100644 --- a/data/2026/CVE-2026-121913.json +++ b/data/2026/CVE-2026-121913.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-121913","lastModified":"2026-11-11T11:17:15.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121913","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:44.817088Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.920","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-121913","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121913","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:57:44.817088Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.920","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121998.json b/data/2026/CVE-2026-121998.json index ffb06edbda..20ea243462 100644 --- a/data/2026/CVE-2026-121998.json +++ b/data/2026/CVE-2026-121998.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"iChart","vendor":"Unknown","versions":[{"lessThan":"2.2.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, relying only on a nonce that any logged-in user can obtain, allowing users with a role as low as Subscriber to read, modify and permanently delete arbitrary posts and to overwrite a site-wide option."}],"id":"CVE-2026-121998","lastModified":"2026-11-11T12:19:36.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121998","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:19:29.712516Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.270","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/5e24fb30-d902-4195-b387-50a6411c2008/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"iChart","vendor":"Unknown","versions":[{"lessThan":"2.2.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, relying only on a nonce that any logged-in user can obtain, allowing users with a role as low as Subscriber to read, modify and permanently delete arbitrary posts and to overwrite a site-wide option."}],"id":"CVE-2026-121998","lastModified":"2026-11-12T18:44:50.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121998","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:19:29.712516Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.270","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/5e24fb30-d902-4195-b387-50a6411c2008/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122003.json b/data/2026/CVE-2026-122003.json index 80ca9791ef..aaca6187cf 100644 --- a/data/2026/CVE-2026-122003.json +++ b/data/2026/CVE-2026-122003.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Abilities Bridge","vendor":"Unknown","versions":[{"lessThan":"1.4.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and taking over the site, by tricking them into opening a crafted page (CSRF)."}],"id":"CVE-2026-122003","lastModified":"2026-11-12T12:18:20.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122003","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:14.379783Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:12.810","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e421e862-8d7a-4df6-9c5e-dc06a466a0fc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Abilities Bridge","vendor":"Unknown","versions":[{"lessThan":"1.4.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request from the logged-in session cookie, allowing attackers to make a logged-in administrator perform any REST API action, including creating a new administrator account and taking over the site, by tricking them into opening a crafted page (CSRF)."}],"id":"CVE-2026-122003","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122003","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:14.379783Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:12.810","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e421e862-8d7a-4df6-9c5e-dc06a466a0fc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122043.json b/data/2026/CVE-2026-122043.json index 5f850b0ac1..26f5b9b248 100644 --- a/data/2026/CVE-2026-122043.json +++ b/data/2026/CVE-2026-122043.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"repmgr","programFiles":["dbutils.c","repmgrd-physical.c"],"repo":"https://github.com/EnterpriseDB/repmgr","vendor":"EnterpriseDB","versions":[{"lessThan":"5.5.1","status":"affected","version":"4.0.0","versionType":"custom"}]}],"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659"}],"cveTags":[],"descriptions":[{"lang":"en","value":"repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability (CWE-78) in event notifications. When event_notification_command is configured, repmgr substitutes the %a (node name), %c (connection string) and %d (details) placeholders into the command and runs it through the shell. %a and %c are inserted without escaping, and %d escapes only double quotes, so shell command substitution still works inside the quoting the documentation recommends. The node name and connection string come from node records in the repmgr.nodes table. An attacker with the credentials of a non-superuser repmgr database user can write a crafted node record and run OS commands, as the operating system user that runs repmgr or repmgrd (usually postgres), on other cluster nodes that process an event using these placeholders. The %a placeholder of failover_validation_command has the same flaw. Deployments whose repmgr database user is a superuser gain no new capability, because a superuser can already run OS commands, and deployments that do not use these placeholders are not affected. The issue is fixed in repmgr 5.5.1. After upgrading, operators must remove any quotes they placed around these placeholders, because a placeholder left inside double quotes is still open to command injection."}],"id":"CVE-2026-122043","lastModified":"2026-11-11T17:17:17.473","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","type":"Secondary"}]},"published":"2026-11-11T17:17:17.473","references":[{"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","url":"https://github.com/EnterpriseDB/repmgr/releases/tag/v5.5.1"},{"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","url":"https://www.enterprisedb.com/docs/security/advisories/cve2026122043/"}],"sourceIdentifier":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"repmgr","programFiles":["dbutils.c","repmgrd-physical.c"],"repo":"https://github.com/EnterpriseDB/repmgr","vendor":"EnterpriseDB","versions":[{"lessThan":"5.5.1","status":"affected","version":"4.0.0","versionType":"custom"}]}],"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659"}],"cveTags":[],"descriptions":[{"lang":"en","value":"repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability (CWE-78) in event notifications. When event_notification_command is configured, repmgr substitutes the %a (node name), %c (connection string) and %d (details) placeholders into the command and runs it through the shell. %a and %c are inserted without escaping, and %d escapes only double quotes, so shell command substitution still works inside the quoting the documentation recommends. The node name and connection string come from node records in the repmgr.nodes table. An attacker with the credentials of a non-superuser repmgr database user can write a crafted node record and run OS commands, as the operating system user that runs repmgr or repmgrd (usually postgres), on other cluster nodes that process an event using these placeholders. The %a placeholder of failover_validation_command has the same flaw. Deployments whose repmgr database user is a superuser gain no new capability, because a superuser can already run OS commands, and deployments that do not use these placeholders are not affected. The issue is fixed in repmgr 5.5.1. After upgrading, operators must remove any quotes they placed around these placeholders, because a placeholder left inside double quotes is still open to command injection."}],"id":"CVE-2026-122043","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","type":"Secondary"}]},"published":"2026-11-11T17:17:17.473","references":[{"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","url":"https://github.com/EnterpriseDB/repmgr/releases/tag/v5.5.1"},{"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","url":"https://www.enterprisedb.com/docs/security/advisories/cve2026122043/"}],"sourceIdentifier":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122044.json b/data/2026/CVE-2026-122044.json index ee480f9af0..a176b12b35 100644 --- a/data/2026/CVE-2026-122044.json +++ b/data/2026/CVE-2026-122044.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Hue Bridge Pro","vendor":"Philips","versions":[{"status":"affected","version":"2071026000"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the failure to apply a protection mechanism. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-33086."}],"id":"CVE-2026-122044","lastModified":"2026-11-12T03:17:11.247","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:11.247","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-892/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Hue Bridge Pro","vendor":"Philips","versions":[{"status":"affected","version":"2071026000"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the failure to apply a protection mechanism. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-33086."}],"id":"CVE-2026-122044","lastModified":"2026-11-12T18:48:46.580","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:11.247","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-892/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-122061.json b/data/2026/CVE-2026-122061.json index aea3f6646d..3050dccdac 100644 --- a/data/2026/CVE-2026-122061.json +++ b/data/2026/CVE-2026-122061.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Event Tickets and Registration","vendor":"Unknown","versions":[{"lessThan":"5.30.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list."}],"id":"CVE-2026-122061","lastModified":"2026-11-11T12:19:36.473","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122061","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:19:18.112942Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.433","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/a3546a21-e420-4482-8bbd-7d8f9b9c9b56/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Event Tickets and Registration","vendor":"Unknown","versions":[{"lessThan":"5.30.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list."}],"id":"CVE-2026-122061","lastModified":"2026-11-12T18:44:50.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122061","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:19:18.112942Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.433","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/a3546a21-e420-4482-8bbd-7d8f9b9c9b56/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122087.json b/data/2026/CVE-2026-122087.json index ffd939cdd8..b66f47f7df 100644 --- a/data/2026/CVE-2026-122087.json +++ b/data/2026/CVE-2026-122087.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Event Tickets and Registration","vendor":"Unknown","versions":[{"lessThan":"5.30.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events."}],"id":"CVE-2026-122087","lastModified":"2026-11-11T12:19:36.640","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122087","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:19:00.545322Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.560","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/773e0e78-9ba2-4d51-9f0e-f8449fd4125b/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Event Tickets and Registration","vendor":"Unknown","versions":[{"lessThan":"5.30.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events."}],"id":"CVE-2026-122087","lastModified":"2026-11-12T18:44:50.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122087","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:19:00.545322Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.560","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/773e0e78-9ba2-4d51-9f0e-f8449fd4125b/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122096.json b/data/2026/CVE-2026-122096.json index 24a87ab524..2cf86e7b1d 100644 --- a/data/2026/CVE-2026-122096.json +++ b/data/2026/CVE-2026-122096.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.datasketches:datasketches-java","packageURL":"pkg:maven/org.apache.datasketches/datasketches-java","product":"Apache DataSketches Java","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"9.0.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.\n\n\n\nSeveral deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.\n\n\n\nThis issue affects Apache DataSketches Java: through 9.0.0.\n\n\n\nUsers are recommended to upgrade to version 9.1.0, which fixes the issue."}],"id":"CVE-2026-122096","lastModified":"2026-11-11T13:17:17.057","metrics":{},"published":"2026-11-11T13:17:17.057","references":[{"source":"security@apache.org","url":"https://github.com/apache/datasketches-java/pull/777"},{"source":"security@apache.org","url":"https://github.com/apache/datasketches-java/pull/783"},{"source":"security@apache.org","url":"https://github.com/apache/datasketches-java/releases/tag/9.1.0"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/9wd7ngmho7hm8x74sq1p2fp1xgjd8kt6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/10/29"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-789"},{"lang":"en","value":"CWE-835"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.datasketches:datasketches-java","packageURL":"pkg:maven/org.apache.datasketches/datasketches-java","product":"Apache DataSketches Java","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"9.0.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.\n\n\n\nSeveral deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.\n\n\n\nThis issue affects Apache DataSketches Java: through 9.0.0.\n\n\n\nUsers are recommended to upgrade to version 9.1.0, which fixes the issue."}],"id":"CVE-2026-122096","lastModified":"2026-11-12T16:59:32.603","metrics":{},"published":"2026-11-11T13:17:17.057","references":[{"source":"security@apache.org","url":"https://github.com/apache/datasketches-java/pull/777"},{"source":"security@apache.org","url":"https://github.com/apache/datasketches-java/pull/783"},{"source":"security@apache.org","url":"https://github.com/apache/datasketches-java/releases/tag/9.1.0"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/9wd7ngmho7hm8x74sq1p2fp1xgjd8kt6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/10/29"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-789"},{"lang":"en","value":"CWE-835"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-122099.json b/data/2026/CVE-2026-122099.json index 48d50a20ae..10cfb296fe 100644 --- a/data/2026/CVE-2026-122099.json +++ b/data/2026/CVE-2026-122099.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-122099","lastModified":"2026-11-10T22:18:28.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:28.330","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-122099","lastModified":"2026-11-12T18:17:19.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122099","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:35.754672Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:28.330","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122100.json b/data/2026/CVE-2026-122100.json index 2012ce930e..df4f11230b 100644 --- a/data/2026/CVE-2026-122100.json +++ b/data/2026/CVE-2026-122100.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page."}],"id":"CVE-2026-122100","lastModified":"2026-11-10T22:18:28.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:28.463","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page."}],"id":"CVE-2026-122100","lastModified":"2026-11-12T20:18:20.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122100","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:11:58.126862Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:28.463","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122102.json b/data/2026/CVE-2026-122102.json index 935a7ee139..60252ce5b5 100644 --- a/data/2026/CVE-2026-122102.json +++ b/data/2026/CVE-2026-122102.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed."}],"id":"CVE-2026-122102","lastModified":"2026-11-10T22:18:28.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:28.730","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed."}],"id":"CVE-2026-122102","lastModified":"2026-11-12T19:16:49.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122102","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:05:35.834764Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:28.730","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122113.json b/data/2026/CVE-2026-122113.json index d0db4222e9..117d0de264 100644 --- a/data/2026/CVE-2026-122113.json +++ b/data/2026/CVE-2026-122113.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"RtUsbA64.sys","vendor":"Realtek","versions":[{"status":"affected","version":"6.3.9600.2393"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and causes a system crash (bugcheck), resulting in a denial of service. No authenticated user session is required."}],"id":"CVE-2026-122113","lastModified":"2026-11-10T19:20:32.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122113","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:21:02.904599Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:43.590","references":[{"source":"cret@cert.org","url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-122113"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"RtUsbA64.sys","vendor":"Realtek","versions":[{"status":"affected","version":"6.3.9600.2393"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and causes a system crash (bugcheck), resulting in a denial of service. No authenticated user session is required."}],"id":"CVE-2026-122113","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122113","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:21:02.904599Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:43.590","references":[{"source":"cret@cert.org","url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-122113"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122116.json b/data/2026/CVE-2026-122116.json index 6380669413..261df1ef94 100644 --- a/data/2026/CVE-2026-122116.json +++ b/data/2026/CVE-2026-122116.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"T3XW Series Phones","vendor":"Yealink","versions":[{"lessThan":"124.87.0.22","status":"affected","version":"124.85.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"T4X Series Phones","vendor":"Yealink","versions":[{"lessThan":"108.87.0.23","status":"affected","version":"108.85.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"T5X Series Phones","vendor":"Yealink","versions":[{"lessThan":"96.87.0.24","status":"affected","version":"96.85.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"T7X Series Phones","vendor":"Yealink","versions":[{"lessThan":"185.87.0.39","status":"affected","version":"185.87.0.5","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"SIP-T85W、SIP-T87W","vendor":"Yealink","versions":[{"lessThan":"185.87.0.39","status":"affected","version":"185.87.0.5","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"AX83H、AX86R","vendor":"Yealink","versions":[{"lessThan":"180.87.0.15","status":"affected","version":"180.86.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"CP925","vendor":"Yealink","versions":[{"lessThan":"148.87.0.41","status":"affected","version":"148.85.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"CP935W","vendor":"Yealink","versions":[{"lessThan":"149.87.0.41","status":"affected","version":"149.85.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Android"],"product":"MP E2 Teams Series","vendor":"Yealink","versions":[{"lessThan":"176.15.0.191","status":"affected","version":"176.15.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Android"],"product":"VP59 Teams","vendor":"Yealink","versions":[{"lessThan":"91.15.1.37","status":"affected","version":"91.15.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Android"],"product":"SIP-T58W","vendor":"Yealink","versions":[{"lessThan":"150.87.0.22","status":"affected","version":"150.86.0.5","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Android"],"product":"VP59","vendor":"Yealink","versions":[{"lessThan":"91.87.0.27","status":"affected","version":"91.86.0.5","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Android"],"product":"CP965","vendor":"Yealink","versions":[{"lessThan":"143.87.0.27","status":"affected","version":"143.86.0.5","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default."}],"id":"CVE-2026-122116","lastModified":"2026-11-04T20:19:11.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122116","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T19:57:46.241561Z","version":"2.0.3"}}]},"published":"2026-11-04T18:17:43.473","references":[{"source":"cve@mitre.org","url":"https://www.yealink.com/en/trust-center/security-bulletins/wifi-8021x-peap-authentication-credential-leakage-vulnerability"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"cve@mitre.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"T3XW Series Phones","vendor":"Yealink","versions":[{"lessThan":"124.87.0.22","status":"affected","version":"124.85.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"T4X Series Phones","vendor":"Yealink","versions":[{"lessThan":"108.87.0.23","status":"affected","version":"108.85.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"T5X Series Phones","vendor":"Yealink","versions":[{"lessThan":"96.87.0.24","status":"affected","version":"96.85.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"T7X Series Phones","vendor":"Yealink","versions":[{"lessThan":"185.87.0.39","status":"affected","version":"185.87.0.5","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"SIP-T85W、SIP-T87W","vendor":"Yealink","versions":[{"lessThan":"185.87.0.39","status":"affected","version":"185.87.0.5","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"AX83H、AX86R","vendor":"Yealink","versions":[{"lessThan":"180.87.0.15","status":"affected","version":"180.86.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"CP925","vendor":"Yealink","versions":[{"lessThan":"148.87.0.41","status":"affected","version":"148.85.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Linux"],"product":"CP935W","vendor":"Yealink","versions":[{"lessThan":"149.87.0.41","status":"affected","version":"149.85.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Android"],"product":"MP E2 Teams Series","vendor":"Yealink","versions":[{"lessThan":"176.15.0.191","status":"affected","version":"176.15.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Android"],"product":"VP59 Teams","vendor":"Yealink","versions":[{"lessThan":"91.15.1.37","status":"affected","version":"91.15.0.1","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Android"],"product":"SIP-T58W","vendor":"Yealink","versions":[{"lessThan":"150.87.0.22","status":"affected","version":"150.86.0.5","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Android"],"product":"VP59","vendor":"Yealink","versions":[{"lessThan":"91.87.0.27","status":"affected","version":"91.86.0.5","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Android"],"product":"CP965","vendor":"Yealink","versions":[{"lessThan":"143.87.0.27","status":"affected","version":"143.86.0.5","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default."}],"id":"CVE-2026-122116","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122116","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T19:57:46.241561Z","version":"2.0.3"}}]},"published":"2026-11-04T18:17:43.473","references":[{"source":"cve@mitre.org","url":"https://www.yealink.com/en/trust-center/security-bulletins/wifi-8021x-peap-authentication-credential-leakage-vulnerability"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"cve@mitre.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122118.json b/data/2026/CVE-2026-122118.json index 190703642c..4ba6c7a604 100644 --- a/data/2026/CVE-2026-122118.json +++ b/data/2026/CVE-2026-122118.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AVHub","vendor":"Yealink","versions":[{"lessThan":"153.135.0.76","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"UVC86","vendor":"Yealink","versions":[{"lessThan":"151.435.0.66","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"SmartVision 80","vendor":"Yealink","versions":[{"lessThan":"321.435.0.86","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"UVC40 E2","vendor":"Yealink","versions":[{"lessThan":"319.410.0.66","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"MeetingBorard C","vendor":"Yealink","versions":[{"lessThan":"328.321.0.40","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"MeetingBar A10","vendor":"Yealink","versions":[{"lessThan":"278.320.0.86","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"MeetingBar A40","vendor":"Yealink","versions":[{"lessThan":"289.320.0.81","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"MeetingBar A50","vendor":"Yealink","versions":[{"lessThan":"323.320.0.54","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic."}],"id":"CVE-2026-122118","lastModified":"2026-11-04T20:19:12.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122118","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T19:54:06.590482Z","version":"2.0.3"}}]},"published":"2026-11-04T18:17:43.667","references":[{"source":"cve@mitre.org","url":"https://www.yealink.com/en/trust-center/security-bulletins/wifi-ap-weak-password-vulnerability"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-334"}],"source":"cve@mitre.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AVHub","vendor":"Yealink","versions":[{"lessThan":"153.135.0.76","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"UVC86","vendor":"Yealink","versions":[{"lessThan":"151.435.0.66","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"SmartVision 80","vendor":"Yealink","versions":[{"lessThan":"321.435.0.86","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"UVC40 E2","vendor":"Yealink","versions":[{"lessThan":"319.410.0.66","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"MeetingBorard C","vendor":"Yealink","versions":[{"lessThan":"328.321.0.40","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"MeetingBar A10","vendor":"Yealink","versions":[{"lessThan":"278.320.0.86","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"MeetingBar A40","vendor":"Yealink","versions":[{"lessThan":"289.320.0.81","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"MeetingBar A50","vendor":"Yealink","versions":[{"lessThan":"323.320.0.54","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic."}],"id":"CVE-2026-122118","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122118","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T19:54:06.590482Z","version":"2.0.3"}}]},"published":"2026-11-04T18:17:43.667","references":[{"source":"cve@mitre.org","url":"https://www.yealink.com/en/trust-center/security-bulletins/wifi-ap-weak-password-vulnerability"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-334"}],"source":"cve@mitre.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122120.json b/data/2026/CVE-2026-122120.json index 2ffa6540ed..f5cb73c93a 100644 --- a/data/2026/CVE-2026-122120.json +++ b/data/2026/CVE-2026-122120.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Plug-in Softwares","vendor":"Yealink","versions":[{"lessThan":"2.35.219.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution."}],"id":"CVE-2026-122120","lastModified":"2026-11-05T19:17:16.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":6.0,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122120","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:52:54.494637Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:39.560","references":[{"source":"cve@mitre.org","url":"https://support.yealink.com/product-detail/0198a686-f259-7994-bd17-7f9d88c3359a"},{"source":"cve@mitre.org","url":"https://www.yealink.com/en/trust-center/security-bulletins/yealink-plugin-softwares-remote-code-execution-vulnerability"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"cve@mitre.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Plug-in Softwares","vendor":"Yealink","versions":[{"lessThan":"2.35.219.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution."}],"id":"CVE-2026-122120","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":6.0,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122120","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:52:54.494637Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:39.560","references":[{"source":"cve@mitre.org","url":"https://support.yealink.com/product-detail/0198a686-f259-7994-bd17-7f9d88c3359a"},{"source":"cve@mitre.org","url":"https://www.yealink.com/en/trust-center/security-bulletins/yealink-plugin-softwares-remote-code-execution-vulnerability"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"cve@mitre.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122124.json b/data/2026/CVE-2026-122124.json index 8a44285569..751325ec28 100644 --- a/data/2026/CVE-2026-122124.json +++ b/data/2026/CVE-2026-122124.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"UVC40 E2","vendor":"Yealink","versions":[{"lessThan":"319.410.0.71","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device."}],"id":"CVE-2026-122124","lastModified":"2026-11-09T22:18:34.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.2,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122124","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:06:31.350611Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:39.727","references":[{"source":"cve@mitre.org","url":"https://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-669"}],"source":"cve@mitre.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"UVC40 E2","vendor":"Yealink","versions":[{"lessThan":"319.410.0.71","status":"affected","version":"0","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device."}],"id":"CVE-2026-122124","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.2,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122124","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:06:31.350611Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:39.727","references":[{"source":"cve@mitre.org","url":"https://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-669"}],"source":"cve@mitre.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122148.json b/data/2026/CVE-2026-122148.json index 0871794442..6b2beedb57 100644 --- a/data/2026/CVE-2026-122148.json +++ b/data/2026/CVE-2026-122148.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Android"],"product":"MeetingBoard Pro","vendor":"Yealink","versions":[{"lessThan":"331.320.0.64","status":"affected","version":"331.320.0.30","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network."}],"id":"CVE-2026-122148","lastModified":"2026-11-05T19:17:16.877","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122148","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T21:11:34.926174Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:39.890","references":[{"source":"cve@mitre.org","url":"https://www.yealink.com/en/trust-center/security-bulletins/web-screenshot-function-front-end-logic-bypass"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-602"}],"source":"cve@mitre.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Android"],"product":"MeetingBoard Pro","vendor":"Yealink","versions":[{"lessThan":"331.320.0.64","status":"affected","version":"331.320.0.30","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network."}],"id":"CVE-2026-122148","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122148","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T21:11:34.926174Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:39.890","references":[{"source":"cve@mitre.org","url":"https://www.yealink.com/en/trust-center/security-bulletins/web-screenshot-function-front-end-logic-bypass"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-602"}],"source":"cve@mitre.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122192.json b/data/2026/CVE-2026-122192.json index 3e99f3c078..cbce939a34 100644 --- a/data/2026/CVE-2026-122192.json +++ b/data/2026/CVE-2026-122192.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"firecracker","vendor":"AWS","versions":[{"lessThan":"1.16.2","status":"affected","version":"0.23.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping.\n\n\n\nTo remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later."}],"id":"CVE-2026-122192","lastModified":"2026-11-09T22:18:34.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":6.0,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:05:56.585868Z","version":"2.0.3"}}]},"published":"2026-11-04T20:19:12.210","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-169-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/firecracker-microvm/firecracker/releases/tag/v1.16.2"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/firecracker-microvm/firecracker/releases/tag/v1.17.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-48ww-rqpp-2mgm"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-390"},{"lang":"en","value":"CWE-825"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"firecracker","vendor":"AWS","versions":[{"lessThan":"1.16.2","status":"affected","version":"0.23.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping.\n\n\n\nTo remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later."}],"id":"CVE-2026-122192","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":6.0,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:05:56.585868Z","version":"2.0.3"}}]},"published":"2026-11-04T20:19:12.210","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-169-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/firecracker-microvm/firecracker/releases/tag/v1.16.2"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/firecracker-microvm/firecracker/releases/tag/v1.17.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-48ww-rqpp-2mgm"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-390"},{"lang":"en","value":"CWE-825"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122193.json b/data/2026/CVE-2026-122193.json index c2d69ac671..959a18cd51 100644 --- a/data/2026/CVE-2026-122193.json +++ b/data/2026/CVE-2026-122193.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"trusted-remote-execution","vendor":"AWS","versions":[{"status":"affected","version":"N/A","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement.\n\n\n\nTo remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run."}],"id":"CVE-2026-122193","lastModified":"2026-11-06T21:17:07.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122193","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:35:18.533469Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:20.313","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-173-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/trusted-remote-execution/trusted-remote-execution/security/advisories/GHSA-95g5-m242-wvhr"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"trusted-remote-execution","vendor":"AWS","versions":[{"status":"affected","version":"N/A","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement.\n\n\n\nTo remediate this issue, users should delete any Rex-RO and Rex-RW SSM documents created from the example script, in each account and Region where it was run."}],"id":"CVE-2026-122193","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122193","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:35:18.533469Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:20.313","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-173-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/trusted-remote-execution/trusted-remote-execution/security/advisories/GHSA-95g5-m242-wvhr"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122266.json b/data/2026/CVE-2026-122266.json index 9663b54322..8eb6be6b77 100644 --- a/data/2026/CVE-2026-122266.json +++ b/data/2026/CVE-2026-122266.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"aws-network-policy-agent","vendor":"AWS","versions":[{"lessThan":"1.3.7","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"amazon-vpc-cni-k8s","vendor":"AWS","versions":[{"lessThan":"1.22.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames.\n\n\n\nTo remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7)."}],"id":"CVE-2026-122266","lastModified":"2026-11-09T22:18:35.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:41:06.814640Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:56.383","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-170-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/amazon-vpc-cni-k8s/releases/tag/v1.22.3"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/amazon-vpc-cni-k8s/security/advisories/GHSA-rp3x-m95q-87mx"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-network-policy-agent/releases/tag/v1.3.7"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-network-policy-agent/security/advisories/GHSA-mm5f-ggvx-hmvw"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1189"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"aws-network-policy-agent","vendor":"AWS","versions":[{"lessThan":"1.3.7","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"amazon-vpc-cni-k8s","vendor":"AWS","versions":[{"lessThan":"1.22.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntrack map poisoning using crafted AF_PACKET frames.\n\n\n\nTo remediate this issue, users should upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later (which includes Network Policy Agent v1.3.7)."}],"id":"CVE-2026-122266","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:41:06.814640Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:56.383","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-170-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/amazon-vpc-cni-k8s/releases/tag/v1.22.3"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/amazon-vpc-cni-k8s/security/advisories/GHSA-rp3x-m95q-87mx"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-network-policy-agent/releases/tag/v1.3.7"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-network-policy-agent/security/advisories/GHSA-mm5f-ggvx-hmvw"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1189"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122267.json b/data/2026/CVE-2026-122267.json index 7a887fa39a..6be70deace 100644 --- a/data/2026/CVE-2026-122267.json +++ b/data/2026/CVE-2026-122267.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MinIO","vendor":"Chainguard","versions":[{"lessThanOrEqual":"RELEASE.2026-09-21T00-15-41Z","status":"affected","version":"0","versionType":"custom"}]}],"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read."}],"id":"CVE-2026-122267","lastModified":"2026-11-10T14:17:15.683","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:01:48.531400Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:55.117","references":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","url":"https://github.com/chainguard-forks/minio/security/advisories/GHSA-48rv-pgqh-mhjg"}],"sourceIdentifier":"82cea9a6-e9e3-46fe-bdb0-3673de380178","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MinIO","vendor":"Chainguard","versions":[{"lessThanOrEqual":"RELEASE.2026-09-21T00-15-41Z","status":"affected","version":"0","versionType":"custom"}]}],"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read."}],"id":"CVE-2026-122267","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:01:48.531400Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:55.117","references":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","url":"https://github.com/chainguard-forks/minio/security/advisories/GHSA-48rv-pgqh-mhjg"}],"sourceIdentifier":"82cea9a6-e9e3-46fe-bdb0-3673de380178","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122300.json b/data/2026/CVE-2026-122300.json index e6cc268452..a9bc68aefc 100644 --- a/data/2026/CVE-2026-122300.json +++ b/data/2026/CVE-2026-122300.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry.\nUsers are recommended to upgrade to Apache Roller 6.1.7 or later."}],"id":"CVE-2026-122300","lastModified":"2026-11-11T13:17:17.207","metrics":{},"published":"2026-11-11T13:17:17.207","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/235"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/s2rmc53o2rdrnq40rxomp1wdfqm3hohs"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove or change entries that member may only read, including entries published by other members. The entry editor checked the member's weblog role but not whether that role permits work on the entry.\nUsers are recommended to upgrade to Apache Roller 6.1.7 or later."}],"id":"CVE-2026-122300","lastModified":"2026-11-12T16:59:32.603","metrics":{},"published":"2026-11-11T13:17:17.207","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/235"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/s2rmc53o2rdrnq40rxomp1wdfqm3hohs"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-123039.json b/data/2026/CVE-2026-123039.json index 72807914d5..e2a651b42d 100644 --- a/data/2026/CVE-2026-123039.json +++ b/data/2026/CVE-2026-123039.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Quantum Security Gateway","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]},{"product":"Quantum Security Management","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"source":"cve@checkpoint.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root."}],"id":"CVE-2026-123039","lastModified":"2026-11-12T14:17:24.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@checkpoint.com","type":"Secondary"}]},"published":"2026-11-12T14:17:24.233","references":[{"source":"cve@checkpoint.com","url":"https://support.checkpoint.com/results/sk/sk1000362"}],"sourceIdentifier":"cve@checkpoint.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"},{"lang":"en","value":"CWE-862"}],"source":"cve@checkpoint.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Quantum Security Gateway","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]},{"product":"Quantum Security Management","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"source":"cve@checkpoint.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root."}],"id":"CVE-2026-123039","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@checkpoint.com","type":"Secondary"}]},"published":"2026-11-12T14:17:24.233","references":[{"source":"cve@checkpoint.com","url":"https://support.checkpoint.com/results/sk/sk1000362"}],"sourceIdentifier":"cve@checkpoint.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"},{"lang":"en","value":"CWE-862"}],"source":"cve@checkpoint.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123040.json b/data/2026/CVE-2026-123040.json index 46f73d436f..fd19746b0a 100644 --- a/data/2026/CVE-2026-123040.json +++ b/data/2026/CVE-2026-123040.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"TrueConf Server","vendor":"TrueConf","versions":[{"lessThan":"5.5.6","status":"affected","version":"4.7.2","versionType":"semver"}]}],"source":"vulnerability@kaspersky.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root."}],"id":"CVE-2026-123040","lastModified":"2026-11-12T05:17:38.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"vulnerability@kaspersky.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vulnerability@kaspersky.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123040","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T14:17:32.280","references":[{"source":"vulnerability@kaspersky.com","url":"https://ics-cert.kaspersky.com/advisories/2026/11/10/trueconf-server-linux-incorrect-default-permissions/"}],"sourceIdentifier":"vulnerability@kaspersky.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"vulnerability@kaspersky.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"TrueConf Server","vendor":"TrueConf","versions":[{"lessThan":"5.5.6","status":"affected","version":"4.7.2","versionType":"semver"}]}],"source":"vulnerability@kaspersky.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root."}],"id":"CVE-2026-123040","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"vulnerability@kaspersky.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vulnerability@kaspersky.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123040","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T14:17:32.280","references":[{"source":"vulnerability@kaspersky.com","url":"https://ics-cert.kaspersky.com/advisories/2026/11/10/trueconf-server-linux-incorrect-default-permissions/"}],"sourceIdentifier":"vulnerability@kaspersky.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"vulnerability@kaspersky.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123041.json b/data/2026/CVE-2026-123041.json index a3631c8155..736b5ca154 100644 --- a/data/2026/CVE-2026-123041.json +++ b/data/2026/CVE-2026-123041.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a caller to be served to another."}],"id":"CVE-2026-123041","lastModified":"2026-11-10T22:18:28.870","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:18:28.870","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a caller to be served to another."}],"id":"CVE-2026-123041","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:18:28.870","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123044.json b/data/2026/CVE-2026-123044.json index 25a6f4a934..73cbdf2b82 100644 --- a/data/2026/CVE-2026-123044.json +++ b/data/2026/CVE-2026-123044.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ContentPen","vendor":"Unknown","versions":[{"lessThan":"1.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators."}],"id":"CVE-2026-123044","lastModified":"2026-11-12T12:18:20.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123044","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:01.302086Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:12.920","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/646b9448-ee17-4852-8f42-c086625e5983/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ContentPen","vendor":"Unknown","versions":[{"lessThan":"1.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators."}],"id":"CVE-2026-123044","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123044","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:18:01.302086Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:12.920","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/646b9448-ee17-4852-8f42-c086625e5983/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123047.json b/data/2026/CVE-2026-123047.json index a5895d4a00..9c51e861cc 100644 --- a/data/2026/CVE-2026-123047.json +++ b/data/2026/CVE-2026-123047.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse BaSyx Helm Charts","vendor":"Eclipse Foundation","versions":[{"lessThan":"3.12.2","status":"affected","version":"3.0.0-rc.1","versionType":"custom"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap.\n\n\n\nThe template `keycloak-init-config.yaml` rendered `keycloak.initialization.users`, including each user's `credentials[].value`, as `users.json` into the persistent ConfigMap `-basyx-keycloak-init-config`. By default this includes the bootstrap administrator user. That user holds the `admin` role and has a non-temporary password. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the password from the ConfigMap and log in to Keycloak as this user. The resulting token carries the `admin` role, which the default BaSyx ABAC rules map to full rights on all BaSyx APIs in the deployment.\n\n\n\nThe bundled Keycloak is disabled by default. The issue is fixed in version 3.12.2 of the `basyx` chart, which moves the initialization users to the Keycloak credentials Secret. Affected users should upgrade and change the passwords of users that were created through the chart."}],"id":"CVE-2026-123047","lastModified":"2026-11-05T19:17:17.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123047","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:54:46.133265Z","version":"2.0.3"}}]},"published":"2026-11-05T13:17:07.493","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/pull/106"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/releases/tag/basyx-3.12.2"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/security/advisories/GHSA-6438-759f-6f8v"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/547"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"},{"lang":"en","value":"CWE-522"}],"source":"emo@eclipse.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse BaSyx Helm Charts","vendor":"Eclipse Foundation","versions":[{"lessThan":"3.12.2","status":"affected","version":"3.0.0-rc.1","versionType":"custom"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap.\n\n\n\nThe template `keycloak-init-config.yaml` rendered `keycloak.initialization.users`, including each user's `credentials[].value`, as `users.json` into the persistent ConfigMap `-basyx-keycloak-init-config`. By default this includes the bootstrap administrator user. That user holds the `admin` role and has a non-temporary password. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the password from the ConfigMap and log in to Keycloak as this user. The resulting token carries the `admin` role, which the default BaSyx ABAC rules map to full rights on all BaSyx APIs in the deployment.\n\n\n\nThe bundled Keycloak is disabled by default. The issue is fixed in version 3.12.2 of the `basyx` chart, which moves the initialization users to the Keycloak credentials Secret. Affected users should upgrade and change the passwords of users that were created through the chart."}],"id":"CVE-2026-123047","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123047","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:54:46.133265Z","version":"2.0.3"}}]},"published":"2026-11-05T13:17:07.493","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/pull/106"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/releases/tag/basyx-3.12.2"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/security/advisories/GHSA-6438-759f-6f8v"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/547"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"},{"lang":"en","value":"CWE-522"}],"source":"emo@eclipse.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123059.json b/data/2026/CVE-2026-123059.json index a786a1fe69..c6b693eddc 100644 --- a/data/2026/CVE-2026-123059.json +++ b/data/2026/CVE-2026-123059.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse BaSyx Helm Charts","vendor":"Eclipse Foundation","versions":[{"status":"affected","version":"2.2.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak enabled store the client secret of the `basyx-technical-user` OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm `admin` role.\n\n\n\nThe chart correctly writes `keycloak.technicalUser.clientSecret` to a Kubernetes Secret, but the template `basyx-keycloak-realm.yaml` also substitutes the same value into the Keycloak realm-import JSON, which is stored in the ConfigMap `-realm`. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the client secret from the ConfigMap. They can then exchange it at the Keycloak token endpoint for an access token with the `admin` role. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and registries in the deployment.\n\n\n\nThe bundled Keycloak is disabled by default. No fixed release of the `aas-basyx-v2-full` chart exists. Affected users should migrate to the `basyx` chart, or deploy without the bundled Keycloak and rotate the `basyx-technical-user` client secret."}],"id":"CVE-2026-123059","lastModified":"2026-11-05T22:17:55.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123059","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:24:06.286598Z","version":"2.0.3"}}]},"published":"2026-11-05T14:17:04.940","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/pull/46"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/releases/tag/aas-basyx-v2-full-2.2.0"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/security/advisories/GHSA-6438-759f-6f8v"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/546"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"},{"lang":"en","value":"CWE-522"}],"source":"emo@eclipse.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse BaSyx Helm Charts","vendor":"Eclipse Foundation","versions":[{"status":"affected","version":"2.2.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak enabled store the client secret of the `basyx-technical-user` OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm `admin` role.\n\n\n\nThe chart correctly writes `keycloak.technicalUser.clientSecret` to a Kubernetes Secret, but the template `basyx-keycloak-realm.yaml` also substitutes the same value into the Keycloak realm-import JSON, which is stored in the ConfigMap `-realm`. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the client secret from the ConfigMap. They can then exchange it at the Keycloak token endpoint for an access token with the `admin` role. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and registries in the deployment.\n\n\n\nThe bundled Keycloak is disabled by default. No fixed release of the `aas-basyx-v2-full` chart exists. Affected users should migrate to the `basyx` chart, or deploy without the bundled Keycloak and rotate the `basyx-technical-user` client secret."}],"id":"CVE-2026-123059","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123059","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:24:06.286598Z","version":"2.0.3"}}]},"published":"2026-11-05T14:17:04.940","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/pull/46"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/releases/tag/aas-basyx-v2-full-2.2.0"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/charts/security/advisories/GHSA-6438-759f-6f8v"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/546"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"},{"lang":"en","value":"CWE-522"}],"source":"emo@eclipse.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123082.json b/data/2026/CVE-2026-123082.json index e6b42c049c..1713cb1596 100644 --- a/data/2026/CVE-2026-123082.json +++ b/data/2026/CVE-2026-123082.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","platforms":["Linux","MacOS","Windows"],"product":"Docker Desktop","vendor":"Docker","versions":[{"lessThan":"4.94.0","status":"affected","version":"4.43.0","versionType":"semver"},{"status":"unaffected","version":"4.94.0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading."}],"id":"CVE-2026-123082","lastModified":"2026-11-10T15:17:16.033","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-10T15:17:16.033","references":[{"source":"security@docker.com","url":"https://docs.docker.com/desktop/release-notes/#4940"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security@docker.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:docker:desktop:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","platforms":["Linux","MacOS","Windows"],"product":"Docker Desktop","vendor":"Docker","versions":[{"lessThan":"4.94.0","status":"affected","version":"4.43.0","versionType":"semver"},{"status":"unaffected","version":"4.94.0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading."}],"id":"CVE-2026-123082","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-10T15:17:16.033","references":[{"source":"security@docker.com","url":"https://docs.docker.com/desktop/release-notes/#4940"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security@docker.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123084.json b/data/2026/CVE-2026-123084.json index 75b4438bc1..5067f6411f 100644 --- a/data/2026/CVE-2026-123084.json +++ b/data/2026/CVE-2026-123084.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unknown","packageName":"ansible-automation-platform-24/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unknown","packageName":"ansible-automation-platform-25/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"python3.11-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"python3.12-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unknown","packageName":"python3x-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unknown","packageName":"python-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"python3.12-pulpcore","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"python-pulpcore","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unknown","packageName":"python-pulpcore","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"python-pulpcore-client","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"python-pulpcore-client","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-tp-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the content guard in the **Pulpcore** package. The guard is supposed to check a value in a request header. It saves a jq filter and runs that filter against the header when a client asks for content. The filter is not limited to the header, and jq's env builtin also returns the environment of the content process. A low-privileged network attacker or user who can create a header content guard and attach it to a distribution can save a filter that reads that environment. The content request is allowed or denied according to the filter result. Repeating the request lets that attacker or user recover the environment, including Pulp settings held there, such as the Django secret key or the database password."}],"id":"CVE-2026-123084","lastModified":"2026-11-10T23:17:20.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-10T23:17:19.997","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-123084"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567260"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-917"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unknown","packageName":"ansible-automation-platform-24/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unknown","packageName":"ansible-automation-platform-25/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"python3.11-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"python3.12-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unknown","packageName":"python3x-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unknown","packageName":"python-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"python3.12-pulpcore","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"python-pulpcore","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unknown","packageName":"python-pulpcore","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"python-pulpcore-client","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"python-pulpcore-client","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-tp-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the content guard in the **Pulpcore** package. The guard is supposed to check a value in a request header. It saves a jq filter and runs that filter against the header when a client asks for content. The filter is not limited to the header, and jq's env builtin also returns the environment of the content process. A low-privileged network attacker or user who can create a header content guard and attach it to a distribution can save a filter that reads that environment. The content request is allowed or denied according to the filter result. Repeating the request lets that attacker or user recover the environment, including Pulp settings held there, such as the Django secret key or the database password."}],"id":"CVE-2026-123084","lastModified":"2026-11-12T18:17:19.973","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:51.054841Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:19.997","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-123084"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567260"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-917"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123092.json b/data/2026/CVE-2026-123092.json index d6ec640cb5..0c41f6951d 100644 --- a/data/2026/CVE-2026-123092.json +++ b/data/2026/CVE-2026-123092.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP Remote Users Sync","vendor":"Unknown","versions":[{"lessThan":"2.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator."}],"id":"CVE-2026-123092","lastModified":"2026-11-12T12:18:20.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:52.382346Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.023","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/31ed11db-eb07-4628-8ad8-5b545c6f8fe0/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP Remote Users Sync","vendor":"Unknown","versions":[{"lessThan":"2.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user synchronisation requests, allowing a site that holds the shared synchronisation keys to set the capabilities of any existing account and escalate it to administrator."}],"id":"CVE-2026-123092","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:52.382346Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.023","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/31ed11db-eb07-4628-8ad8-5b545c6f8fe0/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123134.json b/data/2026/CVE-2026-123134.json index 1361539a5d..c746be0de1 100644 --- a/data/2026/CVE-2026-123134.json +++ b/data/2026/CVE-2026-123134.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Smoove abandoned cart trigger for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"4.3.6","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators."}],"id":"CVE-2026-123134","lastModified":"2026-11-11T12:19:40.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123134","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:18:51.000817Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.693","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/ad3a49ed-4740-4503-9c08-8c0fac5fc270/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Smoove abandoned cart trigger for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"4.3.6","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators."}],"id":"CVE-2026-123134","lastModified":"2026-11-12T18:44:50.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123134","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:18:51.000817Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.693","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/ad3a49ed-4740-4503-9c08-8c0fac5fc270/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123179.json b/data/2026/CVE-2026-123179.json index f5030dd436..10badae293 100644 --- a/data/2026/CVE-2026-123179.json +++ b/data/2026/CVE-2026-123179.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3","versionType":"custom"},{"status":"unaffected","version":"10.7.4","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a local authenticated attacker to cause a denial of service."}],"id":"CVE-2026-123179","lastModified":"2026-11-10T22:18:29.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:40:20.134353Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:18.370","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1188"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3","versionType":"custom"},{"status":"unaffected","version":"10.7.4","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a local authenticated attacker to cause a denial of service."}],"id":"CVE-2026-123179","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:40:20.134353Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:18.370","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1188"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123181.json b/data/2026/CVE-2026-123181.json index f5a8e216d4..e225204a65 100644 --- a/data/2026/CVE-2026-123181.json +++ b/data/2026/CVE-2026-123181.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3"},{"status":"unaffected","version":"10.7.4"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges."}],"id":"CVE-2026-123181","lastModified":"2026-11-10T18:17:21.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":4.2,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:18.503","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Sentry","vendor":"Ivanti","versions":[{"status":"unaffected","version":"11.0.0","versionType":"custom"},{"status":"unaffected","version":"10.8.3"},{"status":"unaffected","version":"10.7.4"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges."}],"id":"CVE-2026-123181","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":4.2,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:18.503","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-105425-CVE-2026-105669-CVE-2026-123179-and-CVE-2026-123181"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123184.json b/data/2026/CVE-2026-123184.json index 54b3a16257..5f825e59f4 100644 --- a/data/2026/CVE-2026-123184.json +++ b/data/2026/CVE-2026-123184.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","modules":["Git Service (repository push permission check)"],"platforms":["Web"],"product":"Altium 365","vendor":"Altium","versions":[{"status":"affected","version":"unspecified"}]}],"source":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}],"cveTags":[{"sourceIdentifier":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of access to the project. As a result, an authenticated user with view-only access to a project could write to that project's git repository.\n\n\n\n\nRead access was evaluated correctly and was not affected, and exploitation requires an authenticated account with existing access to the target project. The issue has been remediated in Altium 365 at the service level and no customer action is required. On-premise Altium Enterprise Server is not affected."}],"id":"CVE-2026-123184","lastModified":"2026-11-05T20:17:50.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123184","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:02:13.994643Z","version":"2.0.3"}}]},"published":"2026-11-05T18:17:08.000","references":[{"source":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","url":"https://www.altium.com/platform/security-compliance/security-advisories"}],"sourceIdentifier":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-863"}],"source":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","modules":["Git Service (repository push permission check)"],"platforms":["Web"],"product":"Altium 365","vendor":"Altium","versions":[{"status":"affected","version":"unspecified"}]}],"source":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}],"cveTags":[{"sourceIdentifier":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of access to the project. As a result, an authenticated user with view-only access to a project could write to that project's git repository.\n\n\n\n\nRead access was evaluated correctly and was not affected, and exploitation requires an authenticated account with existing access to the target project. The issue has been remediated in Altium 365 at the service level and no customer action is required. On-premise Altium Enterprise Server is not affected."}],"id":"CVE-2026-123184","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123184","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:02:13.994643Z","version":"2.0.3"}}]},"published":"2026-11-05T18:17:08.000","references":[{"source":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","url":"https://www.altium.com/platform/security-compliance/security-advisories"}],"sourceIdentifier":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-863"}],"source":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123258.json b/data/2026/CVE-2026-123258.json index fe20a2360c..e3ddd5ad7a 100644 --- a/data/2026/CVE-2026-123258.json +++ b/data/2026/CVE-2026-123258.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 SP25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-123258","lastModified":"2026-11-10T22:18:29.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:29.120","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 SP25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-123258","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:29.120","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-123259.json b/data/2026/CVE-2026-123259.json index caa1b69d23..0b6a76fd51 100644 --- a/data/2026/CVE-2026-123259.json +++ b/data/2026/CVE-2026-123259.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 SP25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}],"id":"CVE-2026-123259","lastModified":"2026-11-12T15:17:46.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123259","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:06:39.599429Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:29.240","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 SP25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}],"id":"CVE-2026-123259","lastModified":"2026-11-12T16:56:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123259","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:06:39.599429Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:29.240","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123262.json b/data/2026/CVE-2026-123262.json index 173c33279e..906de3aae8 100644 --- a/data/2026/CVE-2026-123262.json +++ b/data/2026/CVE-2026-123262.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-123262","lastModified":"2026-11-10T22:18:29.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:29.680","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-123262","lastModified":"2026-11-12T18:17:20.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:38.572474Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:29.680","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123267.json b/data/2026/CVE-2026-123267.json index ab26fd4e62..528c73ea3b 100644 --- a/data/2026/CVE-2026-123267.json +++ b/data/2026/CVE-2026-123267.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page."}],"id":"CVE-2026-123267","lastModified":"2026-11-10T22:18:29.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:29.820","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page."}],"id":"CVE-2026-123267","lastModified":"2026-11-12T20:18:20.997","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123267","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:11:35.720693Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:29.820","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123270.json b/data/2026/CVE-2026-123270.json index c0aeed42fb..dc28419c19 100644 --- a/data/2026/CVE-2026-123270.json +++ b/data/2026/CVE-2026-123270.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Connect","vendor":"Redpanda Data","versions":[{"lessThanOrEqual":"4.110","status":"affected","version":"4.39","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default and there is no authentication gate protecting the stream CRUD routes. An unauthenticated attacker with network access to TCP/4195 can `POST` a malicious pipeline definition to `/streams/{id}` that includes code-executing processors such as `command`, `subprocess`, `ffi`, or unsafe `sql_raw`, thereby achieving arbitrary RCE on the host with the permissions of the Redpanda Connect service account. Because pipelines can also return command output in-band via HTTP, this vulnerability enables full host compromise, credential theft, and data exfiltration with no user interaction or credentials required. \r\n\r\nStarting with v4.111, the API endpoint was reconfigured as opt-in, so this and later versions are no longer vulnerable by default. However, RCE remains achievable on v4.111 and later if the management API is manually enabled via the `--bind-http` flag."}],"id":"CVE-2026-123270","lastModified":"2026-11-09T18:17:25.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123270","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:52:03.502980Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:25.207","references":[{"source":"cret@cert.org","url":"https://github.com/pagvac/redpanda-connect-unauth-rce"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Connect","vendor":"Redpanda Data","versions":[{"lessThanOrEqual":"4.110","status":"affected","version":"4.39","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default and there is no authentication gate protecting the stream CRUD routes. An unauthenticated attacker with network access to TCP/4195 can `POST` a malicious pipeline definition to `/streams/{id}` that includes code-executing processors such as `command`, `subprocess`, `ffi`, or unsafe `sql_raw`, thereby achieving arbitrary RCE on the host with the permissions of the Redpanda Connect service account. Because pipelines can also return command output in-band via HTTP, this vulnerability enables full host compromise, credential theft, and data exfiltration with no user interaction or credentials required. \r\n\r\nStarting with v4.111, the API endpoint was reconfigured as opt-in, so this and later versions are no longer vulnerable by default. However, RCE remains achievable on v4.111 and later if the management API is manually enabled via the `--bind-http` flag."}],"id":"CVE-2026-123270","lastModified":"2026-11-12T19:21:17.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123270","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:52:03.502980Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:25.207","references":[{"source":"cret@cert.org","url":"https://github.com/pagvac/redpanda-connect-unauth-rce"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123292.json b/data/2026/CVE-2026-123292.json index 062e992318..ae5aaed6e5 100644 --- a/data/2026/CVE-2026-123292.json +++ b/data/2026/CVE-2026-123292.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Datalore","vendor":"JetBrains","versions":[{"lessThan":"2026.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@jetbrains.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid"}],"id":"CVE-2026-123292","lastModified":"2026-11-06T21:29:48.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"cve@jetbrains.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T14:01:44.906482Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:07.887","references":[{"source":"cve@jetbrains.com","url":"https://www.jetbrains.com/privacy-security/issues-fixed/"}],"sourceIdentifier":"cve@jetbrains.com","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Datalore","vendor":"JetBrains","versions":[{"lessThan":"2026.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@jetbrains.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:jetbrains:datalore:*:*:*:*:*:*:*:*","matchCriteriaId":"25FE1AD4-12AD-45A4-9E01-CC7C0E2D7585","versionEndExcluding":"2026.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid"}],"id":"CVE-2026-123292","lastModified":"2026-11-12T20:23:40.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"cve@jetbrains.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T14:01:44.906482Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:07.887","references":[{"source":"cve@jetbrains.com","tags":["Vendor Advisory"],"url":"https://www.jetbrains.com/privacy-security/issues-fixed/"}],"sourceIdentifier":"cve@jetbrains.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-123341.json b/data/2026/CVE-2026-123341.json index 987a778606..e7174f9a5d 100644 --- a/data/2026/CVE-2026-123341.json +++ b/data/2026/CVE-2026-123341.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThan":"2026.10.28871","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.28871","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed."}],"id":"CVE-2026-123341","lastModified":"2026-11-10T22:18:29.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:29.953","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThan":"2026.10.28871","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.28871","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed."}],"id":"CVE-2026-123341","lastModified":"2026-11-12T18:17:20.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123341","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:43.956500Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:29.953","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123357.json b/data/2026/CVE-2026-123357.json index de849c628c..d9717cadc4 100644 --- a/data/2026/CVE-2026-123357.json +++ b/data/2026/CVE-2026-123357.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"grobid","vendor":"grobidOrg","versions":[{"status":"affected","version":"< 0.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversion path in grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java passes an attacker-influenced PDF filename through DocumentSource.pdfalto, which interpolates the path into a bash -c command string. A single quote in the filename can terminate the intended quoting, and ProcessRunner.run in grobid-core/src/main/java/org/grobid/core/process/ProcessRunner.java starts the resulting command through ProcessBuilder, allowing arbitrary commands to execute with GROBID process privileges. The bundled REST server path is not affected. This issue is fixed in version 0.9.1."}],"id":"CVE-2026-123357","lastModified":"2026-11-07T19:17:27.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":0.0,"baseSeverity":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":0.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123357","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:33:16.236459Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:44.393","references":[{"source":"security-advisories@github.com","url":"https://github.com/grobidOrg/grobid/pull/1477"},{"source":"security-advisories@github.com","url":"https://github.com/grobidOrg/grobid/releases/tag/0.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-mgxf-7mg7-qpmf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"grobid","vendor":"grobidOrg","versions":[{"status":"affected","version":"< 0.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversion path in grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java passes an attacker-influenced PDF filename through DocumentSource.pdfalto, which interpolates the path into a bash -c command string. A single quote in the filename can terminate the intended quoting, and ProcessRunner.run in grobid-core/src/main/java/org/grobid/core/process/ProcessRunner.java starts the resulting command through ProcessBuilder, allowing arbitrary commands to execute with GROBID process privileges. The bundled REST server path is not affected. This issue is fixed in version 0.9.1."}],"id":"CVE-2026-123357","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":0.0,"baseSeverity":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":0.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123357","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:33:16.236459Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:44.393","references":[{"source":"security-advisories@github.com","url":"https://github.com/grobidOrg/grobid/pull/1477"},{"source":"security-advisories@github.com","url":"https://github.com/grobidOrg/grobid/releases/tag/0.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/grobidOrg/grobid/security/advisories/GHSA-mgxf-7mg7-qpmf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123374.json b/data/2026/CVE-2026-123374.json index ae20e2c8f1..01e6fb9240 100644 --- a/data/2026/CVE-2026-123374.json +++ b/data/2026/CVE-2026-123374.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/apache/roller","defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization."}],"id":"CVE-2026-123374","lastModified":"2026-11-11T13:17:17.340","metrics":{},"published":"2026-11-11T13:17:17.340","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/236"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/577orljt8673gcvcv6nvwo2tnvykyxmt"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/apache/roller","defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization."}],"id":"CVE-2026-123374","lastModified":"2026-11-12T16:59:32.603","metrics":{},"published":"2026-11-11T13:17:17.340","references":[{"source":"security@apache.org","url":"https://github.com/apache/roller/pull/236"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/577orljt8673gcvcv6nvwo2tnvykyxmt"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-123528.json b/data/2026/CVE-2026-123528.json index 9ddb2f38fd..e5a036e082 100644 --- a/data/2026/CVE-2026-123528.json +++ b/data/2026/CVE-2026-123528.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/code.vikunja.io/api","product":"vikunja","vendor":"go-vikunja","versions":[{"lessThan":"2.7.1","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access."}],"id":"CVE-2026-123528","lastModified":"2026-11-08T02:16:42.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T02:16:42.657","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qvp-948j-4cgv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-insufficient-session-expiration-via-http-token-middleware"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/code.vikunja.io/api","product":"vikunja","vendor":"go-vikunja","versions":[{"lessThan":"2.7.1","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.7.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access."}],"id":"CVE-2026-123528","lastModified":"2026-11-12T18:17:20.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123528","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:49:56.976974Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:42.657","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qvp-948j-4cgv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-insufficient-session-expiration-via-http-token-middleware"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qvp-948j-4cgv"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123549.json b/data/2026/CVE-2026-123549.json index a898eb1913..590ca5526e 100644 --- a/data/2026/CVE-2026-123549.json +++ b/data/2026/CVE-2026-123549.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:maven/org.openidentityplatform.openam/openam-core-rest","product":"OpenAM","vendor":"OpenIdentityPlatform","versions":[{"lessThan":"16.1.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"16.1.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM."}],"id":"CVE-2026-123549","lastModified":"2026-11-10T22:13:29.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T02:16:46.247","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-jv8f-m88g-h6mm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-privilege-escalation-via-self-registration-attribute-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:maven/org.openidentityplatform.openam/openam-core-rest","product":"OpenAM","vendor":"OpenIdentityPlatform","versions":[{"lessThan":"16.1.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"16.1.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM."}],"id":"CVE-2026-123549","lastModified":"2026-11-12T19:16:50.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123549","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:53:08.622779Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:46.247","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-jv8f-m88g-h6mm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-privilege-escalation-via-self-registration-attribute-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123561.json b/data/2026/CVE-2026-123561.json index 23e9efd9bf..67d161d70a 100644 --- a/data/2026/CVE-2026-123561.json +++ b/data/2026/CVE-2026-123561.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/devalue","product":"devalue","vendor":"sveltejs","versions":[{"lessThan":"5.9.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.9.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own property, which alone does not cause prototype pollution."}],"id":"CVE-2026-123561","lastModified":"2026-11-10T18:17:25.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123561","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:41:56.785673Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:48.400","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-4q55-j62x-fr9h"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.9.3-proto-rejection-bypass-via-property-key-coercion"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/devalue","product":"devalue","vendor":"sveltejs","versions":[{"lessThan":"5.9.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.9.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own property, which alone does not cause prototype pollution."}],"id":"CVE-2026-123561","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123561","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:41:56.785673Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:48.400","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-4q55-j62x-fr9h"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.9.3-proto-rejection-bypass-via-property-key-coercion"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123564.json b/data/2026/CVE-2026-123564.json index 8951cd43f2..b36893a46a 100644 --- a/data/2026/CVE-2026-123564.json +++ b/data/2026/CVE-2026-123564.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/devalue","product":"devalue","vendor":"sveltejs","versions":[{"lessThan":"5.9.3","status":"affected","version":"1.0.0","versionType":"semver"},{"status":"unaffected","version":"5.9.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime evaluating the output."}],"id":"CVE-2026-123564","lastModified":"2026-11-12T13:17:14.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123564","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:02:04.902891Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:48.877","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-wf3x-273g-mvxv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.9.3-memory-exhaustion-via-uneval-sparse-arrays"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/devalue","product":"devalue","vendor":"sveltejs","versions":[{"lessThan":"5.9.3","status":"affected","version":"1.0.0","versionType":"semver"},{"status":"unaffected","version":"5.9.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime evaluating the output."}],"id":"CVE-2026-123564","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123564","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:02:04.902891Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:48.877","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-wf3x-273g-mvxv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.9.3-memory-exhaustion-via-uneval-sparse-arrays"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123565.json b/data/2026/CVE-2026-123565.json index 294b90d1ab..df4b475e01 100644 --- a/data/2026/CVE-2026-123565.json +++ b/data/2026/CVE-2026-123565.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/devalue","product":"devalue","vendor":"sveltejs","versions":[{"lessThan":"5.9.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.9.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU."}],"id":"CVE-2026-123565","lastModified":"2026-11-10T18:17:25.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123565","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:29:19.440498Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:49.040","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/devalue-before-5.9.3-quadratic-expansion-denial-of-service-via-uneval"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/devalue","product":"devalue","vendor":"sveltejs","versions":[{"lessThan":"5.9.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.9.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU."}],"id":"CVE-2026-123565","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123565","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:29:19.440498Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:49.040","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/devalue-before-5.9.3-quadratic-expansion-denial-of-service-via-uneval"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123568.json b/data/2026/CVE-2026-123568.json index ec69ccf9de..2f24f0dc73 100644 --- a/data/2026/CVE-2026-123568.json +++ b/data/2026/CVE-2026-123568.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/devalue","product":"devalue","vendor":"sveltejs","versions":[{"lessThan":"5.6.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.6.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input."}],"id":"CVE-2026-123568","lastModified":"2026-11-12T13:17:14.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:03:03.428600Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:49.513","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-8qm3-746x-r74r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.6.3-prototype-pollution-via-uneval-output"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/devalue","product":"devalue","vendor":"sveltejs","versions":[{"lessThan":"5.6.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.6.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input."}],"id":"CVE-2026-123568","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:03:03.428600Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:49.513","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-8qm3-746x-r74r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.6.3-prototype-pollution-via-uneval-output"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123569.json b/data/2026/CVE-2026-123569.json index f3f022c8fa..67f6c118b5 100644 --- a/data/2026/CVE-2026-123569.json +++ b/data/2026/CVE-2026-123569.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/devalue","product":"devalue","vendor":"sveltejs","versions":[{"lessThan":"5.6.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.6.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service."}],"id":"CVE-2026-123569","lastModified":"2026-11-10T18:17:25.973","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123569","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:29:22.021173Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:49.673","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-33hq-fvwr-56pm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/devalue-before-5.6.3-denial-of-service-via-sparse-array-serialization"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/devalue","product":"devalue","vendor":"sveltejs","versions":[{"lessThan":"5.6.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.6.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service."}],"id":"CVE-2026-123569","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123569","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:29:22.021173Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:49.673","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-33hq-fvwr-56pm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/devalue-before-5.6.3-denial-of-service-via-sparse-array-serialization"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123572.json b/data/2026/CVE-2026-123572.json index 020b35fe50..ebd93b122c 100644 --- a/data/2026/CVE-2026-123572.json +++ b/data/2026/CVE-2026-123572.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-proto","product":"hickory-dns","vendor":"hickory-dns","versions":[{"lessThan":"0.26.2","status":"affected","version":"0.20.1","versionType":"semver"},{"status":"unaffected","version":"0.26.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes."}],"id":"CVE-2026-123572","lastModified":"2026-11-10T22:15:59.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T02:16:50.140","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/hickory-dns-0.20.1-before-0.26.2-panic-dos-via-svcb-https-zone-parser"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1286"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:cargo/hickory-proto","product":"hickory-dns","vendor":"hickory-dns","versions":[{"lessThan":"0.26.2","status":"affected","version":"0.20.1","versionType":"semver"},{"status":"unaffected","version":"0.26.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes in alpn parameters to crash parsing processes."}],"id":"CVE-2026-123572","lastModified":"2026-11-12T18:17:20.640","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123572","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:50:51.241591Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:50.140","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/hickory-dns-0.20.1-before-0.26.2-panic-dos-via-svcb-https-zone-parser"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1286"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123609.json b/data/2026/CVE-2026-123609.json index 02bde9e41b..8e2317429d 100644 --- a/data/2026/CVE-2026-123609.json +++ b/data/2026/CVE-2026-123609.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:cargo/rustls","product":"rustls","vendor":"rustls","versions":[{"lessThan":"0.23.46","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"0.23.46","versionType":"semver"},{"lessThan":"0.24.0-dev.2","status":"affected","version":"0.24.0-dev.1","versionType":"semver"},{"status":"unaffected","version":"0.24.0-dev.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers."}],"id":"CVE-2026-123609","lastModified":"2026-11-10T18:17:27.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.3,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:42:07.621483Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:56.083","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rustls-before-0.23.46-and-0.24.0-dev.1-before-0.24.0-dev.2-secret-exposure-via-debug"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-212"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:cargo/rustls","product":"rustls","vendor":"rustls","versions":[{"lessThan":"0.23.46","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"0.23.46","versionType":"semver"},{"lessThan":"0.24.0-dev.2","status":"affected","version":"0.24.0-dev.1","versionType":"semver"},{"status":"unaffected","version":"0.24.0-dev.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13ClientSessionValue can leak TLS 1.2 master secrets or TLS 1.3 resumption PSKs to log readers."}],"id":"CVE-2026-123609","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.3,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:42:07.621483Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:56.083","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/rustls/rustls/security/advisories/GHSA-c8m5-c952-6cm4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rustls-before-0.23.46-and-0.24.0-dev.1-before-0.24.0-dev.2-secret-exposure-via-debug"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-212"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123613.json b/data/2026/CVE-2026-123613.json index d4ab413d14..71a6e260ec 100644 --- a/data/2026/CVE-2026-123613.json +++ b/data/2026/CVE-2026-123613.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:cargo/rustls","product":"rustls","vendor":"rustls","versions":[{"lessThan":"0.23.45","status":"affected","version":"0.23.13","versionType":"semver"},{"status":"unaffected","version":"0.23.45","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted."}],"id":"CVE-2026-123613","lastModified":"2026-11-10T18:17:27.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123613","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:29:35.553397Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:56.780","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/rustls/rustls/commit/5046bdf8a612b35a2c1a9e168054c1d5c65e7dd7"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rustls-0.23.13-before-0.23.45-tls-1.3-handshake-encryption-level-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:cargo/rustls","product":"rustls","vendor":"rustls","versions":[{"lessThan":"0.23.45","status":"affected","version":"0.23.13","versionType":"semver"},{"status":"unaffected","version":"0.23.45","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted."}],"id":"CVE-2026-123613","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123613","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:29:35.553397Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:56.780","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/rustls/rustls/commit/5046bdf8a612b35a2c1a9e168054c1d5c65e7dd7"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rustls-0.23.13-before-0.23.45-tls-1.3-handshake-encryption-level-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123616.json b/data/2026/CVE-2026-123616.json index 6bfcf5584e..3201e3695b 100644 --- a/data/2026/CVE-2026-123616.json +++ b/data/2026/CVE-2026-123616.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"imgproxy","vendor":"imgproxy","versions":[{"lessThan":"4.0.16","status":"affected","version":"3.3.0","versionType":"semver"},{"status":"unaffected","version":"4.0.16","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication."}],"id":"CVE-2026-123616","lastModified":"2026-11-08T02:16:57.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T02:16:57.307","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/imgproxy/imgproxy/security/advisories/GHSA-mmq5-xm89-9pfg"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/imgproxy-3.3.0-before-4.0.16-memory-exhaustion-dos-via-ico-loader"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"imgproxy","vendor":"imgproxy","versions":[{"lessThan":"4.0.16","status":"affected","version":"3.3.0","versionType":"semver"},{"status":"unaffected","version":"4.0.16","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication."}],"id":"CVE-2026-123616","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123616","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:51:53.800227Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:57.307","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/imgproxy/imgproxy/security/advisories/GHSA-mmq5-xm89-9pfg"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/imgproxy-3.3.0-before-4.0.16-memory-exhaustion-dos-via-ico-loader"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/imgproxy/imgproxy/security/advisories/GHSA-mmq5-xm89-9pfg"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123655.json b/data/2026/CVE-2026-123655.json index 8bc83bd82c..22641cd098 100644 --- a/data/2026/CVE-2026-123655.json +++ b/data/2026/CVE-2026-123655.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/moodle/moodle","defaultStatus":"unaffected","packageName":"moodle","versions":[{"lessThan":"4.5.15","status":"affected","version":"4.5.0","versionType":"semver"},{"lessThan":"5.0.11","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThan":"5.1.8","status":"affected","version":"5.1.0","versionType":"semver"},{"lessThan":"5.2.4","status":"affected","version":"5.2.0","versionType":"semver"}]}],"source":"patrick@puiterwijk.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content."}],"id":"CVE-2026-123655","lastModified":"2026-11-06T15:17:20.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"patrick@puiterwijk.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123655","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T13:51:35.603019Z","version":"2.0.3"}}]},"published":"2026-11-06T12:17:20.657","references":[{"source":"patrick@puiterwijk.org","url":"https://access.redhat.com/security/cve/CVE-2026-123655"},{"source":"patrick@puiterwijk.org","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2568053"},{"source":"patrick@puiterwijk.org","url":"https://github.com/moodle/moodle/commit/4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49"},{"source":"patrick@puiterwijk.org","url":"https://moodle.org/mod/forum/discuss.php?d=482830"}],"sourceIdentifier":"patrick@puiterwijk.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"patrick@puiterwijk.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/moodle/moodle","defaultStatus":"unaffected","packageName":"moodle","versions":[{"lessThan":"4.5.15","status":"affected","version":"4.5.0","versionType":"semver"},{"lessThan":"5.0.11","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThan":"5.1.8","status":"affected","version":"5.1.0","versionType":"semver"},{"lessThan":"5.2.4","status":"affected","version":"5.2.0","versionType":"semver"}]}],"source":"patrick@puiterwijk.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized information disclosure of protected content."}],"id":"CVE-2026-123655","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"patrick@puiterwijk.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123655","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T13:51:35.603019Z","version":"2.0.3"}}]},"published":"2026-11-06T12:17:20.657","references":[{"source":"patrick@puiterwijk.org","url":"https://access.redhat.com/security/cve/CVE-2026-123655"},{"source":"patrick@puiterwijk.org","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2568053"},{"source":"patrick@puiterwijk.org","url":"https://github.com/moodle/moodle/commit/4b42ce4ed1d132214fd4b7d4b5f4f0387ec28a49"},{"source":"patrick@puiterwijk.org","url":"https://moodle.org/mod/forum/discuss.php?d=482830"}],"sourceIdentifier":"patrick@puiterwijk.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"patrick@puiterwijk.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123656.json b/data/2026/CVE-2026-123656.json index 6e564db30c..49c081eb8b 100644 --- a/data/2026/CVE-2026-123656.json +++ b/data/2026/CVE-2026-123656.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ProfilePress","vendor":"Unknown","versions":[{"lessThan":"4.17.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API."}],"id":"CVE-2026-123656","lastModified":"2026-11-11T06:17:17.830","metrics":{},"published":"2026-11-11T06:17:17.830","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/5a670095-e8c7-4317-a929-a896d01ee648/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ProfilePress","vendor":"Unknown","versions":[{"lessThan":"4.17.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API."}],"id":"CVE-2026-123656","lastModified":"2026-11-12T19:16:51.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123656","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:18:28.570725Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.830","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/5a670095-e8c7-4317-a929-a896d01ee648/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123657.json b/data/2026/CVE-2026-123657.json index 0ac4187b9b..a615e3c211 100644 --- a/data/2026/CVE-2026-123657.json +++ b/data/2026/CVE-2026-123657.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ProfilePress","vendor":"Unknown","versions":[{"lessThan":"4.17.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them."}],"id":"CVE-2026-123657","lastModified":"2026-11-11T12:19:42.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123657","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:18:01.805832Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.950","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/9ddc7296-26be-46ca-9752-d48c88754f55/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ProfilePress","vendor":"Unknown","versions":[{"lessThan":"4.17.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them."}],"id":"CVE-2026-123657","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123657","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:18:01.805832Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:17.950","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/9ddc7296-26be-46ca-9752-d48c88754f55/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123659.json b/data/2026/CVE-2026-123659.json index 1d72a4edd3..a20300e436 100644 --- a/data/2026/CVE-2026-123659.json +++ b/data/2026/CVE-2026-123659.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"ProfilePress","vendor":"Unknown","versions":[{"lessThan":"4.17.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users."}],"id":"CVE-2026-123659","lastModified":"2026-11-11T12:19:42.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123659","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:12:52.349070Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:17.713","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/01d27477-0971-4ca7-a285-39e81c3df648/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"ProfilePress","vendor":"Unknown","versions":[{"lessThan":"4.17.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users."}],"id":"CVE-2026-123659","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123659","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:12:52.349070Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:17.713","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/01d27477-0971-4ca7-a285-39e81c3df648/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123660.json b/data/2026/CVE-2026-123660.json index bb09586095..e18c6b245a 100644 --- a/data/2026/CVE-2026-123660.json +++ b/data/2026/CVE-2026-123660.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vulnerability-lookup","vendor":"vulnerability-lookup","versions":[{"lessThan":"6.4.1","status":"affected","version":"5.5.1","versionType":"semver"}]}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification's payload template. Each placeholder's format specifier was passed unchanged to Python's string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {\"text\": \"{title:>999999999}\"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels."}],"id":"CVE-2026-123660","lastModified":"2026-11-10T18:17:28.053","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123660","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:39:52.273550Z","version":"2.0.3"}}]},"published":"2026-11-06T09:17:01.367","references":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://github.com/vulnerability-lookup/vulnerability-lookup/commit/2076ffdae3d024649114eeb6fd185338d4bb1f40"}],"sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-770"},{"lang":"en","value":"CWE-1284"}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vulnerability-lookup","vendor":"vulnerability-lookup","versions":[{"lessThan":"6.4.1","status":"affected","version":"5.5.1","versionType":"semver"}]}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification's payload template. Each placeholder's format specifier was passed unchanged to Python's string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {\"text\": \"{title:>999999999}\"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels."}],"id":"CVE-2026-123660","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123660","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:39:52.273550Z","version":"2.0.3"}}]},"published":"2026-11-06T09:17:01.367","references":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://github.com/vulnerability-lookup/vulnerability-lookup/commit/2076ffdae3d024649114eeb6fd185338d4bb1f40"}],"sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-770"},{"lang":"en","value":"CWE-1284"}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123661.json b/data/2026/CVE-2026-123661.json index 926c82937e..9be28694af 100644 --- a/data/2026/CVE-2026-123661.json +++ b/data/2026/CVE-2026-123661.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ProfilePress","vendor":"Unknown","versions":[{"lessThan":"4.17.4","status":"affected","version":"4.16.13","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role."}],"id":"CVE-2026-123661","lastModified":"2026-11-11T12:19:42.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123661","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:51.283304Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.067","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e70de446-003c-4198-9951-e0fb336978f8/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ProfilePress","vendor":"Unknown","versions":[{"lessThan":"4.17.4","status":"affected","version":"4.16.13","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used to change an existing subscription, allowing subscribers holding any subscription of their own to subscribe to plans the site owner has deactivated, including free plans that grant a user role."}],"id":"CVE-2026-123661","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123661","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:51.283304Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.067","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e70de446-003c-4198-9951-e0fb336978f8/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123666.json b/data/2026/CVE-2026-123666.json index 90220e9cf2..bc76cde464 100644 --- a/data/2026/CVE-2026-123666.json +++ b/data/2026/CVE-2026-123666.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Photo Engine (Media Organizer & Lightroom)","vendor":"Unknown","versions":[{"lessThan":"6.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'."}],"id":"CVE-2026-123666","lastModified":"2026-11-11T12:19:42.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123666","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:43.318008Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.200","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/2d65ab42-36cd-4ba1-8c2d-08eae7cd7214/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Photo Engine (Media Organizer & Lightroom)","vendor":"Unknown","versions":[{"lessThan":"6.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media in a collection before deleting it along with the collection, allowing users with the Author role and above to permanently delete other users' synced media, including administrators'."}],"id":"CVE-2026-123666","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123666","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:43.318008Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.200","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/2d65ab42-36cd-4ba1-8c2d-08eae7cd7214/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123667.json b/data/2026/CVE-2026-123667.json index 980d8e30ab..b9df5cfb1e 100644 --- a/data/2026/CVE-2026-123667.json +++ b/data/2026/CVE-2026-123667.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Photo Engine (Media Organizer & Lightroom)","vendor":"Unknown","versions":[{"lessThan":"6.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page."}],"id":"CVE-2026-123667","lastModified":"2026-11-11T12:19:43.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123667","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:34.597285Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.337","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/4dc2a8c5-9f1d-4bec-86fd-6d9b4aae5444/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Photo Engine (Media Organizer & Lightroom)","vendor":"Unknown","versions":[{"lessThan":"6.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page."}],"id":"CVE-2026-123667","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123667","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:34.597285Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.337","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/4dc2a8c5-9f1d-4bec-86fd-6d9b4aae5444/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123668.json b/data/2026/CVE-2026-123668.json index 660fcdf867..d2124c4f23 100644 --- a/data/2026/CVE-2026-123668.json +++ b/data/2026/CVE-2026-123668.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"GetPaid","vendor":"Unknown","versions":[{"lessThan":"2.8.65","status":"affected","version":"2.8.63","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged."}],"id":"CVE-2026-123668","lastModified":"2026-11-11T12:19:43.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123668","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:12:46.709148Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:17.833","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/62c1a6ac-0f9f-4402-b72b-8b10ffe6989c/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"GetPaid","vendor":"Unknown","versions":[{"lessThan":"2.8.65","status":"affected","version":"2.8.63","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged."}],"id":"CVE-2026-123668","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123668","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:12:46.709148Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:17.833","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/62c1a6ac-0f9f-4402-b72b-8b10ffe6989c/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123695.json b/data/2026/CVE-2026-123695.json index 22150dd061..e48933d1d3 100644 --- a/data/2026/CVE-2026-123695.json +++ b/data/2026/CVE-2026-123695.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators."}],"id":"CVE-2026-123695","lastModified":"2026-11-11T12:19:43.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123695","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:25.443694Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.470","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/ad945f05-fc7e-4dad-8a37-b9a6a7acf7e0/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators."}],"id":"CVE-2026-123695","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123695","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:25.443694Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.470","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/ad945f05-fc7e-4dad-8a37-b9a6a7acf7e0/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123696.json b/data/2026/CVE-2026-123696.json index 7a40febdb4..07d0e27a56 100644 --- a/data/2026/CVE-2026-123696.json +++ b/data/2026/CVE-2026-123696.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once."}],"id":"CVE-2026-123696","lastModified":"2026-11-11T12:19:43.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123696","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:12.010368Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.607","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/60efadce-ae1b-448c-9e9c-aa65ee5e028d/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once."}],"id":"CVE-2026-123696","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123696","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:12.010368Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.607","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/60efadce-ae1b-448c-9e9c-aa65ee5e028d/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123697.json b/data/2026/CVE-2026-123697.json index 3bdd683d49..c95b2026f1 100644 --- a/data/2026/CVE-2026-123697.json +++ b/data/2026/CVE-2026-123697.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available."}],"id":"CVE-2026-123697","lastModified":"2026-11-11T12:19:43.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:01.856551Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.730","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password library is available."}],"id":"CVE-2026-123697","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:17:01.856551Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.730","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/58f2562b-e108-46ab-92bb-3430109dab1f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123698.json b/data/2026/CVE-2026-123698.json index 433d3e49a2..23fd8b6d7d 100644 --- a/data/2026/CVE-2026-123698.json +++ b/data/2026/CVE-2026-123698.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve its full settings, including configured secret keys and the hidden login URL."}],"id":"CVE-2026-123698","lastModified":"2026-11-11T12:19:43.927","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123698","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:16:50.155645Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.847","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/f13ecbe7-8abb-4736-be5c-fd38f402181c/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve its full settings, including configured secret keys and the hidden login URL."}],"id":"CVE-2026-123698","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123698","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:16:50.155645Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:18.847","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/f13ecbe7-8abb-4736-be5c-fd38f402181c/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123699.json b/data/2026/CVE-2026-123699.json index c27a970ae8..0e821d86c9 100644 --- a/data/2026/CVE-2026-123699.json +++ b/data/2026/CVE-2026-123699.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16, and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site."}],"id":"CVE-2026-123699","lastModified":"2026-11-11T12:19:44.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123699","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:16:39.482996Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.010","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security For WooCommerce WordPress plugin through 1.0.16, and WordPress core updates, allowing unauthenticated users to force every pending update to be installed on the site."}],"id":"CVE-2026-123699","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123699","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:16:39.482996Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.010","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/344ca520-dc28-4d52-a400-559d23359d23/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123700.json b/data/2026/CVE-2026-123700.json index c11e975852..192d48d01d 100644 --- a/data/2026/CVE-2026-123700.json +++ b/data/2026/CVE-2026-123700.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes."}],"id":"CVE-2026-123700","lastModified":"2026-11-11T12:19:44.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123700","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:16:28.379088Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.163","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/3facdee3-eb7e-458c-b496-9946f8e2d1f0/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and WooCommerce order notes."}],"id":"CVE-2026-123700","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123700","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:16:28.379088Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.163","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/3facdee3-eb7e-458c-b496-9946f8e2d1f0/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123701.json b/data/2026/CVE-2026-123701.json index 388087e809..68a855d9df 100644 --- a/data/2026/CVE-2026-123701.json +++ b/data/2026/CVE-2026-123701.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall."}],"id":"CVE-2026-123701","lastModified":"2026-11-11T12:19:44.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123701","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:16:18.974179Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.333","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowing unauthenticated users to reset any section of its configuration to the defaults and so disable security features such as a custom login URL, two-factor authentication, reCAPTCHA, password policies and the firewall."}],"id":"CVE-2026-123701","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123701","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:16:18.974179Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.333","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/9d65f64f-b9d5-488d-a81d-4013a1b1fc9e/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123702.json b/data/2026/CVE-2026-123702.json index 698875e360..105298d3e4 100644 --- a/data/2026/CVE-2026-123702.json +++ b/data/2026/CVE-2026-123702.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline."}],"id":"CVE-2026-123702","lastModified":"2026-11-11T12:19:44.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123702","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:16:06.350939Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.450","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret keys and salts in the site's configuration file, allowing unauthenticated users to log out every user and, on servers that cannot reach the WordPress.org API, corrupt the configuration file and take the whole site offline."}],"id":"CVE-2026-123702","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123702","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:16:06.350939Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.450","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/28de2af4-74aa-497d-9f1a-69d40c72fea5/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123703.json b/data/2026/CVE-2026-123703.json index 0562855059..e4266b95b2 100644 --- a/data/2026/CVE-2026-123703.json +++ b/data/2026/CVE-2026-123703.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request."}],"id":"CVE-2026-123703","lastModified":"2026-11-11T12:19:44.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123703","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:15:57.405557Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.580","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/6b255385-26ae-416c-8c2d-a673508aa212/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a user's login sessions, allowing unauthenticated visitors to log out any user, including administrators, and to keep them logged out by repeating the request."}],"id":"CVE-2026-123703","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123703","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:15:57.405557Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.580","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/6b255385-26ae-416c-8c2d-a673508aa212/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123704.json b/data/2026/CVE-2026-123704.json index 66d6affffe..8b960d4e1f 100644 --- a/data/2026/CVE-2026-123704.json +++ b/data/2026/CVE-2026-123704.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site."}],"id":"CVE-2026-123704","lastModified":"2026-11-11T12:19:44.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123704","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:15:47.169070Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.703","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/b7e8fa76-32c0-48ea-a685-2a75ffe94cd1/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site."}],"id":"CVE-2026-123704","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123704","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:15:47.169070Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.703","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/b7e8fa76-32c0-48ea-a685-2a75ffe94cd1/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123705.json b/data/2026/CVE-2026-123705.json index 5178d2a025..3bce48a30d 100644 --- a/data/2026/CVE-2026-123705.json +++ b/data/2026/CVE-2026-123705.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve a detailed report of the server, PHP and WordPress configuration, including installed Security For WooCommerce WordPress plugin through 1.0.16 and versions and the site administrator's email address."}],"id":"CVE-2026-123705","lastModified":"2026-11-11T12:19:45.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123705","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:15:35.657307Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.830","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/cb9bbd7a-c13a-4129-a910-45746af203ce/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Security For WooCommerce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.16","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve a detailed report of the server, PHP and WordPress configuration, including installed Security For WooCommerce WordPress plugin through 1.0.16 and versions and the site administrator's email address."}],"id":"CVE-2026-123705","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123705","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:15:35.657307Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:19.830","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/cb9bbd7a-c13a-4129-a910-45746af203ce/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123717.json b/data/2026/CVE-2026-123717.json index 7db3c538f4..ec57211db8 100644 --- a/data/2026/CVE-2026-123717.json +++ b/data/2026/CVE-2026-123717.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org/project/otterdog/","defaultStatus":"unaffected","packageName":"otterdog","product":"otterdog","repo":"https://github.com/eclipse-csi/otterdog","vendor":"Eclipse CSI","versions":[{"lessThanOrEqual":"1.7.1","status":"affected","version":"0.1.0","versionType":"semver"},{"status":"unaffected","version":"1.8.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass: or bitwarden:@) or credential identifier that is resolved when otterdog apply is run."}],"id":"CVE-2026-123717","lastModified":"2026-11-10T12:17:17.380","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T12:17:17.380","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-csi/otterdog/releases/tag/v1.8.0"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-886p-g538-rcmp"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/552"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org/project/otterdog/","defaultStatus":"unaffected","packageName":"otterdog","product":"otterdog","repo":"https://github.com/eclipse-csi/otterdog","vendor":"Eclipse CSI","versions":[{"lessThanOrEqual":"1.7.1","status":"affected","version":"0.1.0","versionType":"semver"},{"status":"unaffected","version":"1.8.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass: or bitwarden:@) or credential identifier that is resolved when otterdog apply is run."}],"id":"CVE-2026-123717","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T12:17:17.380","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-csi/otterdog/releases/tag/v1.8.0"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-886p-g538-rcmp"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/552"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-123747.json b/data/2026/CVE-2026-123747.json index 202cec0be9..ffe8acd830 100644 --- a/data/2026/CVE-2026-123747.json +++ b/data/2026/CVE-2026-123747.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/OpenPrinting/pappl-retrofit","defaultStatus":"unaffected","packageName":"pappl-retrofit","product":"pappl-retrofit","vendor":"OpenPrinting","versions":[{"lessThanOrEqual":"1.0b2","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"pappl-retrofit","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution."}],"id":"CVE-2026-123747","lastModified":"2026-11-11T19:17:30.677","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.8,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T19:17:30.467","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-123747"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2568110"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/9"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/OpenPrinting/pappl-retrofit","defaultStatus":"unaffected","packageName":"pappl-retrofit","product":"pappl-retrofit","vendor":"OpenPrinting","versions":[{"lessThanOrEqual":"1.0b2","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"pappl-retrofit","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution."}],"id":"CVE-2026-123747","lastModified":"2026-11-12T18:17:20.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.8,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123747","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:18.931846Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:30.467","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-123747"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2568110"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/9"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123753.json b/data/2026/CVE-2026-123753.json index 2c3485d0ff..b7964bf033 100644 --- a/data/2026/CVE-2026-123753.json +++ b/data/2026/CVE-2026-123753.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-kernel","packageURL":"pkg:maven/org.apache.axis2/axis2-kernel","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-123753","lastModified":"2026-11-09T11:17:23.920","metrics":{},"published":"2026-11-09T11:17:23.920","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1b6856b4d7903780786c79327bed1b53ea051a15"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/rddzl5jfmlr09yr9qj33by7kzprwwvnc"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/23"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-kernel","packageURL":"pkg:maven/org.apache.axis2/axis2-kernel","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-123753","lastModified":"2026-11-12T17:17:29.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123753","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:22:17.477533Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:23.920","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1b6856b4d7903780786c79327bed1b53ea051a15"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/rddzl5jfmlr09yr9qj33by7kzprwwvnc"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/23"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123765.json b/data/2026/CVE-2026-123765.json index 8990f93a40..9f404b683f 100644 --- a/data/2026/CVE-2026-123765.json +++ b/data/2026/CVE-2026-123765.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.sling:org.apache.sling.xss","packageURL":"pkg:maven/org.apache.sling/org.apache.sling.xss","product":"Apache Sling XSS","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.4.14","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.14.\n\n\n\nUsers are recommended to upgrade to version 2.4.14, which fixes the issue."}],"id":"CVE-2026-123765","lastModified":"2026-11-12T11:17:08.570","metrics":{},"published":"2026-11-12T10:17:28.523","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/ddvvg034rwqpnsqz8sw0rldyqqoh9c92"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/22"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.sling:org.apache.sling.xss","packageURL":"pkg:maven/org.apache.sling/org.apache.sling.xss","product":"Apache Sling XSS","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.4.14","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.14.\n\n\n\nUsers are recommended to upgrade to version 2.4.14, which fixes the issue."}],"id":"CVE-2026-123765","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-12T10:17:28.523","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/ddvvg034rwqpnsqz8sw0rldyqqoh9c92"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/22"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123766.json b/data/2026/CVE-2026-123766.json index 5e0ec36605..446473a12b 100644 --- a/data/2026/CVE-2026-123766.json +++ b/data/2026/CVE-2026-123766.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-openapi","packageURL":"pkg:maven/org.apache.axis2/axis2-openapi","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"2.0.1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-123766","lastModified":"2026-11-09T11:17:24.050","metrics":{},"published":"2026-11-09T11:17:24.050","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/gzxdd4gobm1kb0jdonmn4n8xhjkwlrbg"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/24"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-openapi","packageURL":"pkg:maven/org.apache.axis2/axis2-openapi","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"2.0.1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-123766","lastModified":"2026-11-12T20:18:21.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123766","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:56:27.662687Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:24.050","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/gzxdd4gobm1kb0jdonmn4n8xhjkwlrbg"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/24"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123770.json b/data/2026/CVE-2026-123770.json index a924202a66..0bd4a02bf5 100644 --- a/data/2026/CVE-2026-123770.json +++ b/data/2026/CVE-2026-123770.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-kernel","packageURL":"pkg:maven/org.apache.axis2/axis2-kernel","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply, and multipart temporary files were not deleted. An unauthenticated caller could exhaust memory or disk. Version 2.0.2 bounds these bodies with configurable limits and deletes temporary files. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-123770","lastModified":"2026-11-12T16:18:57.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123770","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:43:56.184952Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:24.180","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/2b98e5a31c793589915711f5e29fb4ffb697de70"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/94c935d1406bc0875daebd36994595efa2f48ae0"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/78poyrrggq8tjoos5tgw508m7oylqjlg"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/25"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-kernel","packageURL":"pkg:maven/org.apache.axis2/axis2-kernel","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply, and multipart temporary files were not deleted. An unauthenticated caller could exhaust memory or disk. Version 2.0.2 bounds these bodies with configurable limits and deletes temporary files. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-123770","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123770","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:43:56.184952Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:24.180","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/2b98e5a31c793589915711f5e29fb4ffb697de70"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/94c935d1406bc0875daebd36994595efa2f48ae0"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/78poyrrggq8tjoos5tgw508m7oylqjlg"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/25"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123776.json b/data/2026/CVE-2026-123776.json index 8a0c7d9cda..f44f8a75d4 100644 --- a/data/2026/CVE-2026-123776.json +++ b/data/2026/CVE-2026-123776.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["RRD::CGI::Image"],"packageName":"RRD-CGI-Image","packageURL":"pkg:cpan/RRD-CGI-Image","programFiles":["lib/RRD/CGI/Image.pm"],"programRoutines":[{"name":"RRD::CGI::Image::normalize_params"}],"versions":[{"lessThanOrEqual":"0.01","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting \"tz\" to tzset(), , so a FIFO or device path blocks the CGI process.\n\nThe normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset()."}],"id":"CVE-2026-123776","lastModified":"2026-11-10T14:17:16.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123776","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:11:31.610638Z","version":"2.0.3"}}]},"published":"2026-11-07T12:17:46.093","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://man7.org/linux/man-pages/man3/tzset.3.html"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://rt.cpan.org/Ticket/Display.html?id=182627"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://security.metacpan.org/patches/R/RRD-CGI-Image/0.01/CVE-2026-123776-r1.patch"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/07/11"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["RRD::CGI::Image"],"packageName":"RRD-CGI-Image","packageURL":"pkg:cpan/RRD-CGI-Image","programFiles":["lib/RRD/CGI/Image.pm"],"programRoutines":[{"name":"RRD::CGI::Image::normalize_params"}],"versions":[{"lessThanOrEqual":"0.01","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting \"tz\" to tzset(), , so a FIFO or device path blocks the CGI process.\n\nThe normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset()."}],"id":"CVE-2026-123776","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123776","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:11:31.610638Z","version":"2.0.3"}}]},"published":"2026-11-07T12:17:46.093","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://man7.org/linux/man-pages/man3/tzset.3.html"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://rt.cpan.org/Ticket/Display.html?id=182627"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://security.metacpan.org/patches/R/RRD-CGI-Image/0.01/CVE-2026-123776-r1.patch"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/07/11"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123779.json b/data/2026/CVE-2026-123779.json index fdf9322ddd..40965e78c9 100644 --- a/data/2026/CVE-2026-123779.json +++ b/data/2026/CVE-2026-123779.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-transport-http","packageURL":"pkg:maven/org.apache.axis2/axis2-transport-http","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-openapi","packageURL":"pkg:maven/org.apache.axis2/axis2-openapi","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-123779","lastModified":"2026-11-09T11:17:24.310","metrics":{},"published":"2026-11-09T11:17:24.310","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/8a81216b1b723e98a3c801de939201ad68f59b23"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/qqn6c4fb8tj0ldmb97c75zzxdjrh5dl3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/28"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-425"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-transport-http","packageURL":"pkg:maven/org.apache.axis2/axis2-transport-http","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.axis2:axis2-openapi","packageURL":"pkg:maven/org.apache.axis2/axis2-openapi","product":"Apache Axis2/Java","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue."}],"id":"CVE-2026-123779","lastModified":"2026-11-12T17:17:29.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123779","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:24:55.842592Z","version":"2.0.3"}}]},"published":"2026-11-09T11:17:24.310","references":[{"source":"security@apache.org","url":"https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-java-core/commit/8a81216b1b723e98a3c801de939201ad68f59b23"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/qqn6c4fb8tj0ldmb97c75zzxdjrh5dl3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/28"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-425"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123790.json b/data/2026/CVE-2026-123790.json index ec33250413..b195ec6a8f 100644 --- a/data/2026/CVE-2026-123790.json +++ b/data/2026/CVE-2026-123790.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ComfyUI-Easy-Use","vendor":"ComfyUI-Easy-Use","versions":[{"lessThanOrEqual":"1.4.1","status":"affected","version":"1.3.6","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST `/easyuse/save/{name}`. The handler checks the source directory before appending a user-supplied filename and allows the request to select the `custom_nodes` directory as a copy destination. An unauthenticated attacker who can reach the ComfyUI server can overwrite an installed custom node’s Python entry point with an uploaded file. When ComfyUI restarts and loads the modified node, the attacker’s code runs with the privileges of the ComfyUI process."}],"id":"CVE-2026-123790","lastModified":"2026-11-12T16:18:58.050","metrics":{},"published":"2026-11-12T15:17:46.667","references":[{"source":"cret@cert.org","url":"https://blog.nhhoang.io.vn/posts/2026/11/cve-2026-123790-comfyui-easy-use-save-preview-rce/"},{"source":"cret@cert.org","url":"https://github.com/yolain/ComfyUI-Easy-Use"},{"source":"cret@cert.org","url":"https://github.com/yolain/ComfyUI-Easy-Use/commit/8a0f2fc412c1c6f9109e9392064800a87a706775"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"ComfyUI-Easy-Use","vendor":"ComfyUI-Easy-Use","versions":[{"lessThanOrEqual":"1.4.1","status":"affected","version":"1.3.6","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST `/easyuse/save/{name}`. The handler checks the source directory before appending a user-supplied filename and allows the request to select the `custom_nodes` directory as a copy destination. An unauthenticated attacker who can reach the ComfyUI server can overwrite an installed custom node’s Python entry point with an uploaded file. When ComfyUI restarts and loads the modified node, the attacker’s code runs with the privileges of the ComfyUI process."}],"id":"CVE-2026-123790","lastModified":"2026-11-12T19:22:01.433","metrics":{},"published":"2026-11-12T15:17:46.667","references":[{"source":"cret@cert.org","url":"https://blog.nhhoang.io.vn/posts/2026/11/cve-2026-123790-comfyui-easy-use-save-preview-rce/"},{"source":"cret@cert.org","url":"https://github.com/yolain/ComfyUI-Easy-Use"},{"source":"cret@cert.org","url":"https://github.com/yolain/ComfyUI-Easy-Use/commit/8a0f2fc412c1c6f9109e9392064800a87a706775"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.kb.cert.org/vuls/id/944667"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-123797.json b/data/2026/CVE-2026-123797.json index 9fad44c9a4..1b565fba8f 100644 --- a/data/2026/CVE-2026-123797.json +++ b/data/2026/CVE-2026-123797.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"supertokens-core","vendor":"supertokens","versions":[{"status":"affected","version":"< 11.3.6"},{"status":"affected","version":">= 11.4.0, < 11.4.6"},{"status":"affected","version":">= 12.0.6, < 12.0.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8."}],"id":"CVE-2026-123797","lastModified":"2026-11-09T18:17:26.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T18:17:26.890","references":[{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/1bad648d7b77aca058cb6bf75373455bacc4e537"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/5811a10190b1d4d8d7a9fe2e17cb49437e6ffa49"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/7ce22db2b6ba95d7666adc51bb9ee60ac7d3d198"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.6"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.6"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.8"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-q7mc-f2jm-r4gr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"supertokens-core","vendor":"supertokens","versions":[{"status":"affected","version":"< 11.3.6"},{"status":"affected","version":">= 11.4.0, < 11.4.6"},{"status":"affected","version":">= 12.0.6, < 12.0.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8."}],"id":"CVE-2026-123797","lastModified":"2026-11-12T19:16:51.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123797","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:16.301952Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:26.890","references":[{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/1bad648d7b77aca058cb6bf75373455bacc4e537"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/5811a10190b1d4d8d7a9fe2e17cb49437e6ffa49"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/7ce22db2b6ba95d7666adc51bb9ee60ac7d3d198"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.6"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.6"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.8"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-q7mc-f2jm-r4gr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123805.json b/data/2026/CVE-2026-123805.json index a3518259af..e8a62bc16e 100644 --- a/data/2026/CVE-2026-123805.json +++ b/data/2026/CVE-2026-123805.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"sipsorcery","vendor":"sipsorcery-org","versions":[{"status":"affected","version":"< 10.0.14"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14."}],"id":"CVE-2026-123805","lastModified":"2026-11-09T20:18:10.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T20:18:10.173","references":[{"source":"security-advisories@github.com","url":"https://github.com/sipsorcery-org/sipsorcery/commit/a2466550bb2a28821c73fb1961bc33dcc467f8cf"},{"source":"security-advisories@github.com","url":"https://github.com/sipsorcery-org/sipsorcery/pull/1772"},{"source":"security-advisories@github.com","url":"https://github.com/sipsorcery-org/sipsorcery/security/advisories/GHSA-jwjp-4649-v8jp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-755"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"sipsorcery","vendor":"sipsorcery-org","versions":[{"status":"affected","version":"< 10.0.14"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14."}],"id":"CVE-2026-123805","lastModified":"2026-11-12T19:16:51.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123805","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:26.973425Z","version":"2.0.3"}}]},"published":"2026-11-09T20:18:10.173","references":[{"source":"security-advisories@github.com","url":"https://github.com/sipsorcery-org/sipsorcery/commit/a2466550bb2a28821c73fb1961bc33dcc467f8cf"},{"source":"security-advisories@github.com","url":"https://github.com/sipsorcery-org/sipsorcery/pull/1772"},{"source":"security-advisories@github.com","url":"https://github.com/sipsorcery-org/sipsorcery/security/advisories/GHSA-jwjp-4649-v8jp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-755"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123818.json b/data/2026/CVE-2026-123818.json index bbef87d701..c64e3fd911 100644 --- a/data/2026/CVE-2026-123818.json +++ b/data/2026/CVE-2026-123818.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"lmdeploy","vendor":"InternLM","versions":[{"status":"affected","version":">= 0.12.3, < 0.15.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation hostname appears globally routable but whose request destination resolves to an internal host, bypassing non-global address checks. Applications that accept attacker-controlled remote media URLs can therefore be induced to access internal HTTP services and expose data available from those services. This issue is fixed in version 0.15.0."}],"id":"CVE-2026-123818","lastModified":"2026-11-09T22:18:38.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:38.437","references":[{"source":"security-advisories@github.com","url":"https://github.com/InternLM/lmdeploy/commit/03c313006d17cc3feae86b633c44206a997c44db"},{"source":"security-advisories@github.com","url":"https://github.com/InternLM/lmdeploy/pull/4734"},{"source":"security-advisories@github.com","url":"https://github.com/InternLM/lmdeploy/releases/tag/v0.15.0"},{"source":"security-advisories@github.com","url":"https://github.com/InternLM/lmdeploy/security/advisories/GHSA-39wr-7q6h-cf68"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"lmdeploy","vendor":"InternLM","versions":[{"status":"affected","version":">= 0.12.3, < 0.15.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation hostname appears globally routable but whose request destination resolves to an internal host, bypassing non-global address checks. Applications that accept attacker-controlled remote media URLs can therefore be induced to access internal HTTP services and expose data available from those services. This issue is fixed in version 0.15.0."}],"id":"CVE-2026-123818","lastModified":"2026-11-12T19:16:51.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123818","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:31.502595Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:38.437","references":[{"source":"security-advisories@github.com","url":"https://github.com/InternLM/lmdeploy/commit/03c313006d17cc3feae86b633c44206a997c44db"},{"source":"security-advisories@github.com","url":"https://github.com/InternLM/lmdeploy/pull/4734"},{"source":"security-advisories@github.com","url":"https://github.com/InternLM/lmdeploy/releases/tag/v0.15.0"},{"source":"security-advisories@github.com","url":"https://github.com/InternLM/lmdeploy/security/advisories/GHSA-39wr-7q6h-cf68"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123819.json b/data/2026/CVE-2026-123819.json index 493cfd77af..d00cbeeb61 100644 --- a/data/2026/CVE-2026-123819.json +++ b/data/2026/CVE-2026-123819.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"wagtail","vendor":"wagtail","versions":[{"status":"affected","version":"< 7.0.9"},{"status":"affected","version":">= 7.1, < 7.3.4"},{"status":"affected","version":">= 7.4, < 7.4.3"},{"status":"affected","version":"= 8.0rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."}],"id":"CVE-2026-123819","lastModified":"2026-11-09T22:18:38.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:38.603","references":[{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/aebf89233c0cc9739e240e1112d705e0c995f79c"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/c06183cc9c9590e4585f27899173bc741bbbcb10"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.3.4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v8.0rc2"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"wagtail","vendor":"wagtail","versions":[{"status":"affected","version":"< 7.0.9"},{"status":"affected","version":">= 7.1, < 7.3.4"},{"status":"affected","version":">= 7.4, < 7.4.3"},{"status":"affected","version":"= 8.0rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."}],"id":"CVE-2026-123819","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:38.603","references":[{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/aebf89233c0cc9739e240e1112d705e0c995f79c"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/c06183cc9c9590e4585f27899173bc741bbbcb10"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.3.4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v8.0rc2"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-123820.json b/data/2026/CVE-2026-123820.json index 8f627f06f1..5abf750ca8 100644 --- a/data/2026/CVE-2026-123820.json +++ b/data/2026/CVE-2026-123820.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"wagtail","vendor":"wagtail","versions":[{"status":"affected","version":"< 7.0.9"},{"status":"affected","version":">= 7.1, < 7.3.4"},{"status":"affected","version":">= 7.4, < 7.4.3"},{"status":"affected","version":"= 8.0rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Images API V2 excludes directly restricted collections but fails to exclude their descendant collections, even though descendants inherit ancestor view restrictions. An API user can therefore list the filenames and names of documents and images stored in descendant collections that should remain private. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."}],"id":"CVE-2026-123820","lastModified":"2026-11-10T17:17:24.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123820","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:15:50.550784Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:38.770","references":[{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/320c37ed4624702d3864ce2364ce8536b2ce5115"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/9a69e0ad153c515ddd86ddd33d2c9d2554201568"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/b8a2040dfcdb97498b746254ad8bb4e47e21358c"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/cba80389067121c0fae41a3312e2daf76f0eb206"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.3.4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v8.0rc2"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-c2xx-cjmh-9q8f"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"wagtail","vendor":"wagtail","versions":[{"status":"affected","version":"< 7.0.9"},{"status":"affected","version":">= 7.1, < 7.3.4"},{"status":"affected","version":">= 7.4, < 7.4.3"},{"status":"affected","version":"= 8.0rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Images API V2 excludes directly restricted collections but fails to exclude their descendant collections, even though descendants inherit ancestor view restrictions. An API user can therefore list the filenames and names of documents and images stored in descendant collections that should remain private. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."}],"id":"CVE-2026-123820","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123820","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:15:50.550784Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:38.770","references":[{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/320c37ed4624702d3864ce2364ce8536b2ce5115"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/9a69e0ad153c515ddd86ddd33d2c9d2554201568"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/b8a2040dfcdb97498b746254ad8bb4e47e21358c"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/cba80389067121c0fae41a3312e2daf76f0eb206"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.3.4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v8.0rc2"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-c2xx-cjmh-9q8f"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123828.json b/data/2026/CVE-2026-123828.json index 32b60e4ae8..ec7c4f26a6 100644 --- a/data/2026/CVE-2026-123828.json +++ b/data/2026/CVE-2026-123828.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x."}],"id":"CVE-2026-123828","lastModified":"2026-11-11T19:17:30.740","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:30.740","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x."}],"id":"CVE-2026-123828","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:30.740","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123829.json b/data/2026/CVE-2026-123829.json index 5b2a75011d..5e429ed279 100644 --- a/data/2026/CVE-2026-123829.json +++ b/data/2026/CVE-2026-123829.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123829","lastModified":"2026-11-11T19:17:32.143","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.0"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:32.143","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123829","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.0"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:32.143","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123834.json b/data/2026/CVE-2026-123834.json index f89af3e1f9..0868d111ed 100644 --- a/data/2026/CVE-2026-123834.json +++ b/data/2026/CVE-2026-123834.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Datalore","vendor":"JetBrains","versions":[{"lessThan":"2026.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@jetbrains.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account"}],"id":"CVE-2026-123834","lastModified":"2026-11-06T21:17:07.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cve@jetbrains.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:46:47.078150Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:21.680","references":[{"source":"cve@jetbrains.com","url":"https://www.jetbrains.com/privacy-security/issues-fixed/"}],"sourceIdentifier":"cve@jetbrains.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"cve@jetbrains.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Datalore","vendor":"JetBrains","versions":[{"lessThan":"2026.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@jetbrains.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:jetbrains:datalore:*:*:*:*:*:*:*:*","matchCriteriaId":"25FE1AD4-12AD-45A4-9E01-CC7C0E2D7585","versionEndExcluding":"2026.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account"}],"id":"CVE-2026-123834","lastModified":"2026-11-12T20:24:21.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cve@jetbrains.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:46:47.078150Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:21.680","references":[{"source":"cve@jetbrains.com","tags":["Vendor Advisory"],"url":"https://www.jetbrains.com/privacy-security/issues-fixed/"}],"sourceIdentifier":"cve@jetbrains.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"cve@jetbrains.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123835.json b/data/2026/CVE-2026-123835.json index ee6307ae33..c5dc0737d8 100644 --- a/data/2026/CVE-2026-123835.json +++ b/data/2026/CVE-2026-123835.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Datalore","vendor":"JetBrains","versions":[{"lessThan":"2026.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@jetbrains.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition"}],"id":"CVE-2026-123835","lastModified":"2026-11-06T20:20:05.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"cve@jetbrains.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123835","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:38:33.870689Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:21.823","references":[{"source":"cve@jetbrains.com","url":"https://www.jetbrains.com/privacy-security/issues-fixed/"}],"sourceIdentifier":"cve@jetbrains.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"cve@jetbrains.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Datalore","vendor":"JetBrains","versions":[{"lessThan":"2026.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@jetbrains.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:jetbrains:datalore:*:*:*:*:*:*:*:*","matchCriteriaId":"25FE1AD4-12AD-45A4-9E01-CC7C0E2D7585","versionEndExcluding":"2026.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition"}],"id":"CVE-2026-123835","lastModified":"2026-11-12T20:29:24.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"cve@jetbrains.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123835","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:38:33.870689Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:21.823","references":[{"source":"cve@jetbrains.com","tags":["Vendor Advisory"],"url":"https://www.jetbrains.com/privacy-security/issues-fixed/"}],"sourceIdentifier":"cve@jetbrains.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"cve@jetbrains.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-123836.json b/data/2026/CVE-2026-123836.json index 688f4d8604..f2ada09253 100644 --- a/data/2026/CVE-2026-123836.json +++ b/data/2026/CVE-2026-123836.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Datalore","vendor":"JetBrains","versions":[{"lessThan":"2026.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@jetbrains.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup"}],"id":"CVE-2026-123836","lastModified":"2026-11-06T21:17:07.777","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"cve@jetbrains.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123836","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:46:19.050014Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:21.963","references":[{"source":"cve@jetbrains.com","url":"https://www.jetbrains.com/privacy-security/issues-fixed/"}],"sourceIdentifier":"cve@jetbrains.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"cve@jetbrains.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Datalore","vendor":"JetBrains","versions":[{"lessThan":"2026.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@jetbrains.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:jetbrains:datalore:*:*:*:*:*:*:*:*","matchCriteriaId":"25FE1AD4-12AD-45A4-9E01-CC7C0E2D7585","versionEndExcluding":"2026.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup"}],"id":"CVE-2026-123836","lastModified":"2026-11-12T20:33:49.997","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"cve@jetbrains.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123836","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:46:19.050014Z","version":"2.0.3"}}]},"published":"2026-11-06T17:17:21.963","references":[{"source":"cve@jetbrains.com","tags":["Vendor Advisory"],"url":"https://www.jetbrains.com/privacy-security/issues-fixed/"}],"sourceIdentifier":"cve@jetbrains.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"cve@jetbrains.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123862.json b/data/2026/CVE-2026-123862.json index 6e8a36a0de..fbd8377546 100644 --- a/data/2026/CVE-2026-123862.json +++ b/data/2026/CVE-2026-123862.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream internals and bypasses the stream's error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123862","lastModified":"2026-11-11T19:17:32.360","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.0"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:32.360","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream internals and bypasses the stream's error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123862","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.0"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:32.360","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123863.json b/data/2026/CVE-2026-123863.json index 2a5d537e9e..361625cc96 100644 --- a/data/2026/CVE-2026-123863.json +++ b/data/2026/CVE-2026-123863.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."}],"id":"CVE-2026-123863","lastModified":"2026-11-11T19:17:32.577","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:32.577","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."}],"id":"CVE-2026-123863","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:32.577","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123864.json b/data/2026/CVE-2026-123864.json index a2ae88dc89..83f0509a8d 100644 --- a/data/2026/CVE-2026-123864.json +++ b/data/2026/CVE-2026-123864.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123864","lastModified":"2026-11-11T19:17:32.790","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":5.3,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:32.790","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123864","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":5.3,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:32.790","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123865.json b/data/2026/CVE-2026-123865.json index 5104211aac..a2b1aae7ae 100644 --- a/data/2026/CVE-2026-123865.json +++ b/data/2026/CVE-2026-123865.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123865","lastModified":"2026-11-11T19:17:33.000","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:33.000","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123865","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:33.000","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123866.json b/data/2026/CVE-2026-123866.json index 1afff2f67d..944fdbc923 100644 --- a/data/2026/CVE-2026-123866.json +++ b/data/2026/CVE-2026-123866.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123866","lastModified":"2026-11-11T19:17:33.243","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:33.243","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123866","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:33.243","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123867.json b/data/2026/CVE-2026-123867.json index b35a9699b8..46d2e1da6f 100644 --- a/data/2026/CVE-2026-123867.json +++ b/data/2026/CVE-2026-123867.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, { ca: protectedCA })` but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In `src/crypto/crypto_tls.cc`, `CertCbDone` installs the SNI context's CA only when `setSniContext` succeeds, but `setSniContext` returns `false` for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with `requestCert` and `rejectUnauthorized` enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123867","lastModified":"2026-11-12T15:17:46.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:33.480","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, { ca: protectedCA })` but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In `src/crypto/crypto_tls.cc`, `CertCbDone` installs the SNI context's CA only when `setSniContext` succeeds, but `setSniContext` returns `false` for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with `requestCert` and `rejectUnauthorized` enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123867","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:33.480","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123868.json b/data/2026/CVE-2026-123868.json index bf7564b3aa..109484a0ab 100644 --- a/data/2026/CVE-2026-123868.json +++ b/data/2026/CVE-2026-123868.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x."}],"id":"CVE-2026-123868","lastModified":"2026-11-11T19:17:33.690","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:33.690","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x."}],"id":"CVE-2026-123868","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:33.690","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123870.json b/data/2026/CVE-2026-123870.json index 789dfdc10d..b27b87c8e1 100644 --- a/data/2026/CVE-2026-123870.json +++ b/data/2026/CVE-2026-123870.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org","defaultStatus":"unaffected","modules":["WebApp — GitHub webhook receiver"],"packageName":"otterdog","product":"otterdog","repo":"https://github.com/eclipse-csi/otterdog","vendor":"Eclipse Foundation","versions":[{"lessThan":"1.3.2","status":"affected","version":"0.9.0","versionType":"semver"},{"status":"unaffected","version":"1.3.2"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host."}],"id":"CVE-2026-123870","lastModified":"2026-11-12T15:17:46.940","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.5,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123870","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:47:57.838315Z","version":"2.0.3"}}]},"published":"2026-11-09T09:16:58.653","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-csi/otterdog/commit/bbc9e3ced3665f09fc4632f11b5867524eda7f72"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-32xf-7j44-xq72"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/554"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-32xf-7j44-xq72"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-95"}],"source":"emo@eclipse.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org","defaultStatus":"unaffected","modules":["WebApp — GitHub webhook receiver"],"packageName":"otterdog","product":"otterdog","repo":"https://github.com/eclipse-csi/otterdog","vendor":"Eclipse Foundation","versions":[{"lessThan":"1.3.2","status":"affected","version":"0.9.0","versionType":"semver"},{"status":"unaffected","version":"1.3.2"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host."}],"id":"CVE-2026-123870","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.5,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123870","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:47:57.838315Z","version":"2.0.3"}}]},"published":"2026-11-09T09:16:58.653","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-csi/otterdog/commit/bbc9e3ced3665f09fc4632f11b5867524eda7f72"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-32xf-7j44-xq72"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/554"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-32xf-7j44-xq72"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-95"}],"source":"emo@eclipse.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123871.json b/data/2026/CVE-2026-123871.json index ccb251c24d..db77a03c03 100644 --- a/data/2026/CVE-2026-123871.json +++ b/data/2026/CVE-2026-123871.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123871","lastModified":"2026-11-11T19:17:34.070","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:34.070","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123871","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:34.070","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123872.json b/data/2026/CVE-2026-123872.json index 040e10606d..c24c30230c 100644 --- a/data/2026/CVE-2026-123872.json +++ b/data/2026/CVE-2026-123872.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123872","lastModified":"2026-11-11T19:17:34.270","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:34.270","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123872","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:34.270","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123874.json b/data/2026/CVE-2026-123874.json index 3d8c74ab19..6a70a7d052 100644 --- a/data/2026/CVE-2026-123874.json +++ b/data/2026/CVE-2026-123874.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."}],"id":"CVE-2026-123874","lastModified":"2026-11-11T19:17:34.490","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:34.490","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."}],"id":"CVE-2026-123874","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:34.490","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123875.json b/data/2026/CVE-2026-123875.json index fa11a34cdf..df3f226359 100644 --- a/data/2026/CVE-2026-123875.json +++ b/data/2026/CVE-2026-123875.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123875","lastModified":"2026-11-11T19:17:34.697","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:34.697","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123875","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:34.697","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123877.json b/data/2026/CVE-2026-123877.json index 565984d936..ca2775f974 100644 --- a/data/2026/CVE-2026-123877.json +++ b/data/2026/CVE-2026-123877.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123877","lastModified":"2026-11-11T19:17:34.900","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.0"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:34.900","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"22.23.5","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"24.22.3","status":"affected","version":"23.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}],"id":"CVE-2026-123877","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.0"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:34.900","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12389.json b/data/2026/CVE-2026-12389.json index cc2e424a5e..e924eeebeb 100644 --- a/data/2026/CVE-2026-12389.json +++ b/data/2026/CVE-2026-12389.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"5.59","status":"affected","version":"5.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.0","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack."}],"id":"CVE-2026-12389","lastModified":"2026-11-10T06:17:08.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.7,"impactScore":6.0,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:08.200","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/1a/bd/41/cve-2026-12389pdf-en-US-561248.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"5.59","status":"affected","version":"5.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.0","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack."}],"id":"CVE-2026-12389","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.7,"impactScore":6.0,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12389","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:40:55.693346Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:08.200","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/1a/bd/41/cve-2026-12389pdf-en-US-561248.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123974.json b/data/2026/CVE-2026-123974.json index 0f1ce22d6a..eb49843be9 100644 --- a/data/2026/CVE-2026-123974.json +++ b/data/2026/CVE-2026-123974.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"TorchServe","repo":"https://github.com/pytorch/serve","vendor":"PyTorch","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"semver"}]}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a"}],"cveTags":[{"sourceIdentifier":"7fefd608-56a6-419f-a002-fd8543c0710a","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation."}],"id":"CVE-2026-123974","lastModified":"2026-11-06T21:17:08.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123974","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:18:09.099163Z","version":"2.0.3"}}]},"published":"2026-11-06T20:17:20.633","references":[{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://christbowel.com/blog/torchserve-lpe/"},{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://github.com/Christbowel/torchserve-lpe"}],"sourceIdentifier":"7fefd608-56a6-419f-a002-fd8543c0710a","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-379"}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"TorchServe","repo":"https://github.com/pytorch/serve","vendor":"PyTorch","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"semver"}]}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a"}],"cveTags":[{"sourceIdentifier":"7fefd608-56a6-419f-a002-fd8543c0710a","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation."}],"id":"CVE-2026-123974","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123974","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T20:18:09.099163Z","version":"2.0.3"}}]},"published":"2026-11-06T20:17:20.633","references":[{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://christbowel.com/blog/torchserve-lpe/"},{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","url":"https://github.com/Christbowel/torchserve-lpe"}],"sourceIdentifier":"7fefd608-56a6-419f-a002-fd8543c0710a","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-379"}],"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-123999.json b/data/2026/CVE-2026-123999.json index bb57271e64..978c7d0551 100644 --- a/data/2026/CVE-2026-123999.json +++ b/data/2026/CVE-2026-123999.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/nasa-jpl/ION-DTN","product":"ION-DTN","repo":"https://github.com/nasa-jpl/ION-DTN","vendor":"nasa-jpl","versions":[{"lessThanOrEqual":"4.2.0","status":"affected","version":"3.6.2","versionType":"semver"},{"status":"unaffected","version":"4.2.1-a.2","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads that exceed fixed-size buffer allocations through unbounded strcat operations. Attackers can transmit oversized AMP reports, tables, or macros over the UDP CLA/AMP path or trigger the flaw locally via interactive UI rendering to crash nm_mgr and cause a denial of service halting telemetry collection and operator visibility."}],"id":"CVE-2026-123999","lastModified":"2026-11-09T19:16:47.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:47.650","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.1-a.2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-gmhw-vmwr-wrxh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ion-dtn-heap-buffer-overflow-via-nm-mgr-amp-rendering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/nasa-jpl/ION-DTN","product":"ION-DTN","repo":"https://github.com/nasa-jpl/ION-DTN","vendor":"nasa-jpl","versions":[{"lessThanOrEqual":"4.2.0","status":"affected","version":"3.6.2","versionType":"semver"},{"status":"unaffected","version":"4.2.1-a.2","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon (nm_mgr) string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads that exceed fixed-size buffer allocations through unbounded strcat operations. Attackers can transmit oversized AMP reports, tables, or macros over the UDP CLA/AMP path or trigger the flaw locally via interactive UI rendering to crash nm_mgr and cause a denial of service halting telemetry collection and operator visibility."}],"id":"CVE-2026-123999","lastModified":"2026-11-12T19:16:51.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123999","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:19.019546Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:47.650","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nasa-jpl/ION-DTN/releases/tag/ion-open-source-4.2.1-a.2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-gmhw-vmwr-wrxh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ion-dtn-heap-buffer-overflow-via-nm-mgr-amp-rendering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124002.json b/data/2026/CVE-2026-124002.json new file mode 100644 index 0000000000..bfae06dbdd --- /dev/null +++ b/data/2026/CVE-2026-124002.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.7.0","status":"affected","version":"5.2.3","versionType":"semver"},{"status":"unaffected","version":"5.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124002","lastModified":"2026-11-12T20:18:21.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:21.597","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-authentication-os-command-injection-via-username"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124003.json b/data/2026/CVE-2026-124003.json new file mode 100644 index 0000000000..dd094500e4 --- /dev/null +++ b/data/2026/CVE-2026-124003.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system(\"/usr/bin/lua \"+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124003","lastModified":"2026-11-12T20:18:21.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:21.917","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-setuid-lua-cgi-root-command-injection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124004.json b/data/2026/CVE-2026-124004.json new file mode 100644 index 0000000000..4dd9e9d449 --- /dev/null +++ b/data/2026/CVE-2026-124004.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124004","lastModified":"2026-11-12T20:18:22.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:22.367","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-backdoor-password"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124005.json b/data/2026/CVE-2026-124005.json new file mode 100644 index 0000000000..4be68dd559 --- /dev/null +++ b/data/2026/CVE-2026-124005.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"4.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124005","lastModified":"2026-11-12T20:18:22.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:22.673","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-administrator-password-generation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124006.json b/data/2026/CVE-2026-124006.json new file mode 100644 index 0000000000..899db39a04 --- /dev/null +++ b/data/2026/CVE-2026-124006.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124006","lastModified":"2026-11-12T20:18:23.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.033","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-root-password-generation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"},{"lang":"en","value":"CWE-1392"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124007.json b/data/2026/CVE-2026-124007.json new file mode 100644 index 0000000000..44c2c00372 --- /dev/null +++ b/data/2026/CVE-2026-124007.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124007","lastModified":"2026-11-12T20:18:23.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.387","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-auth-os-command-injection-via-password-field"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124008.json b/data/2026/CVE-2026-124008.json new file mode 100644 index 0000000000..a98cd99b22 --- /dev/null +++ b/data/2026/CVE-2026-124008.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.2.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124008","lastModified":"2026-11-12T20:18:23.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.653","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-devices-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124009.json b/data/2026/CVE-2026-124009.json new file mode 100644 index 0000000000..4e830ecf96 --- /dev/null +++ b/data/2026/CVE-2026-124009.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.2.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124009","lastModified":"2026-11-12T20:18:23.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.960","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-backup-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124010.json b/data/2026/CVE-2026-124010.json new file mode 100644 index 0000000000..d386054113 --- /dev/null +++ b/data/2026/CVE-2026-124010.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124010","lastModified":"2026-11-12T20:18:24.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:24.263","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-command-injection-via-xwconsole-cgi"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124011.json b/data/2026/CVE-2026-124011.json new file mode 100644 index 0000000000..a3cc64e2ae --- /dev/null +++ b/data/2026/CVE-2026-124011.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124011","lastModified":"2026-11-12T20:18:24.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:24.670","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-information-disclosure-via-sysinfo-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124012.json b/data/2026/CVE-2026-124012.json new file mode 100644 index 0000000000..a63e0e29aa --- /dev/null +++ b/data/2026/CVE-2026-124012.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124012","lastModified":"2026-11-12T20:18:24.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:24.970","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-daily-password-authentication-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124013.json b/data/2026/CVE-2026-124013.json new file mode 100644 index 0000000000..40ca6b66cc --- /dev/null +++ b/data/2026/CVE-2026-124013.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124013","lastModified":"2026-11-12T20:18:25.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:25.237","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-api-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124014.json b/data/2026/CVE-2026-124014.json new file mode 100644 index 0000000000..70e7a3a5c8 --- /dev/null +++ b/data/2026/CVE-2026-124014.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"4.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124014","lastModified":"2026-11-12T20:18:25.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:25.590","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-configuration-write-via-config-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124015.json b/data/2026/CVE-2026-124015.json new file mode 100644 index 0000000000..0ee16066e0 --- /dev/null +++ b/data/2026/CVE-2026-124015.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"5.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update_password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password_expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124015","lastModified":"2026-11-12T20:18:26.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:26.277","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-authentication-bypass-via-users-lua"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124018.json b/data/2026/CVE-2026-124018.json index 6ff253afac..4265dc6d07 100644 --- a/data/2026/CVE-2026-124018.json +++ b/data/2026/CVE-2026-124018.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Gutenverse Form – Contact Form Builder, Block Form & Booking Form","vendor":"Jegstudio","versions":[{"lessThan":"3.2.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation."}],"id":"CVE-2026-124018","lastModified":"2026-11-12T14:17:27.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T14:17:27.040","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/gutenverse-form/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gutenverse-form-wordpress-plugin-csv-formula-injection-via-form-submission"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1236"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Gutenverse Form – Contact Form Builder, Block Form & Booking Form","vendor":"Jegstudio","versions":[{"lessThan":"3.2.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation."}],"id":"CVE-2026-124018","lastModified":"2026-11-12T18:17:21.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124018","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:20.354317Z","version":"2.0.3"}}]},"published":"2026-11-12T14:17:27.040","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/gutenverse-form/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gutenverse-form-wordpress-plugin-csv-formula-injection-via-form-submission"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1236"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124023.json b/data/2026/CVE-2026-124023.json index a29e24d326..7d8d1a1f36 100644 --- a/data/2026/CVE-2026-124023.json +++ b/data/2026/CVE-2026-124023.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Axis2/C","repo":"https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git","vendor":"Apache Software Foundation","versions":[{"lessThan":"23110287924e79d05a5b4712298c355d1f05c606","status":"affected","version":"f2b30c159720cf63ada72f19183828533154c749","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Apache Axis2/C","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.0.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its range, reading heap memory past the end of the table. An unauthenticated client could trigger this by sending a crafted XML request to a server built with Guththila, the default parser, causing the request to be parsed incorrectly or, in some cases, the process to crash. The memory read is not returned to the client. This issue affects Apache Axis2/C: through 2.0.0. The fix is available in commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6 and will be included in the next release."}],"id":"CVE-2026-124023","lastModified":"2026-11-12T12:18:21.080","metrics":{},"published":"2026-11-12T11:17:10.253","references":[{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-c-core/commit/23110287924e79d05a5b4712298c355d1f05c606"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-c-core/commit/f01683ec10e8fddb87279ec9351b3239021223e6"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/yzmshl8n819pfy2f3p07r9swgh0b3dfz"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/12/1"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Axis2/C","repo":"https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git","vendor":"Apache Software Foundation","versions":[{"lessThan":"23110287924e79d05a5b4712298c355d1f05c606","status":"affected","version":"f2b30c159720cf63ada72f19183828533154c749","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Apache Axis2/C","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.0.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its range, reading heap memory past the end of the table. An unauthenticated client could trigger this by sending a crafted XML request to a server built with Guththila, the default parser, causing the request to be parsed incorrectly or, in some cases, the process to crash. The memory read is not returned to the client. This issue affects Apache Axis2/C: through 2.0.0. The fix is available in commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6 and will be included in the next release."}],"id":"CVE-2026-124023","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-12T11:17:10.253","references":[{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-c-core/commit/23110287924e79d05a5b4712298c355d1f05c606"},{"source":"security@apache.org","url":"https://github.com/apache/axis-axis2-c-core/commit/f01683ec10e8fddb87279ec9351b3239021223e6"},{"source":"security@apache.org","url":"https://lists.apache.org/thread/yzmshl8n819pfy2f3p07r9swgh0b3dfz"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/12/1"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124033.json b/data/2026/CVE-2026-124033.json index d8d07fe2bb..06c2e09508 100644 --- a/data/2026/CVE-2026-124033.json +++ b/data/2026/CVE-2026-124033.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"aws-parallelcluster","vendor":"AWS","versions":[{"lessThan":"3.16.0","status":"affected","version":"3.0.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command.\n\n\n\nTo remediate this issue, users should upgrade to version 3.16.0 or later."}],"id":"CVE-2026-124033","lastModified":"2026-11-09T22:18:38.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-09T22:18:38.920","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-174-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-parallelcluster/releases/tag/v3.16.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-parallelcluster/security/advisories/GHSA-h79v-mp93-644r"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"aws-parallelcluster","vendor":"AWS","versions":[{"lessThan":"3.16.0","status":"affected","version":"3.0.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command.\n\n\n\nTo remediate this issue, users should upgrade to version 3.16.0 or later."}],"id":"CVE-2026-124033","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124033","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:00:43.978105Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:38.920","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-174-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-parallelcluster/releases/tag/v3.16.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-parallelcluster/security/advisories/GHSA-h79v-mp93-644r"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124034.json b/data/2026/CVE-2026-124034.json index 9cfee39de4..8ea8c55f8c 100644 --- a/data/2026/CVE-2026-124034.json +++ b/data/2026/CVE-2026-124034.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"amazon-braket-sdk","vendor":"AWS","versions":[{"lessThan":"1.127.7","status":"affected","version":"1.10.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 object keys.\n\n\n\nWe recommend you upgrade to amazon-braket-sdk version 1.127.7 or later."}],"id":"CVE-2026-124034","lastModified":"2026-11-09T23:17:18.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-09T23:17:18.287","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-175-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.127.7"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-4hhf-mfx9-3877"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"amazon-braket-sdk","vendor":"AWS","versions":[{"lessThan":"1.127.7","status":"affected","version":"1.10.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 object keys.\n\n\n\nWe recommend you upgrade to amazon-braket-sdk version 1.127.7 or later."}],"id":"CVE-2026-124034","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124034","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:01:54.698784Z","version":"2.0.3"}}]},"published":"2026-11-09T23:17:18.287","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-175-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/amazon-braket/amazon-braket-sdk-python/releases/tag/v1.127.7"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/amazon-braket/amazon-braket-sdk-python/security/advisories/GHSA-4hhf-mfx9-3877"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124035.json b/data/2026/CVE-2026-124035.json index 69acab6510..11b9acce40 100644 --- a/data/2026/CVE-2026-124035.json +++ b/data/2026/CVE-2026-124035.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"amazon-braket-schemas","vendor":"Amazon","versions":[{"lessThan":"1.32.2","status":"affected","version":"1.17.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote authenticated user with S3 write access to the quantum task output location to execute arbitrary code on any machine that retrieves the quantum task results via a crafted task result document.\n\n\n\nWe recommend you upgrade to amazon-braket-schemas version 1.32.2 or later."}],"id":"CVE-2026-124035","lastModified":"2026-11-09T23:17:18.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-09T23:17:18.447","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-175-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/amazon-braket/amazon-braket-schemas-python/releases/tag/v1.32.2"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/amazon-braket/amazon-braket-schemas-python/security/advisories/GHSA-9r5x-g8jm-9mjj"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-470"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"amazon-braket-schemas","vendor":"Amazon","versions":[{"lessThan":"1.32.2","status":"affected","version":"1.17.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote authenticated user with S3 write access to the quantum task output location to execute arbitrary code on any machine that retrieves the quantum task results via a crafted task result document.\n\n\n\nWe recommend you upgrade to amazon-braket-schemas version 1.32.2 or later."}],"id":"CVE-2026-124035","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124035","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:02:46.138932Z","version":"2.0.3"}}]},"published":"2026-11-09T23:17:18.447","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-175-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/amazon-braket/amazon-braket-schemas-python/releases/tag/v1.32.2"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/amazon-braket/amazon-braket-schemas-python/security/advisories/GHSA-9r5x-g8jm-9mjj"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-470"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124036.json b/data/2026/CVE-2026-124036.json index 8a6f132ca9..d1b404a63d 100644 --- a/data/2026/CVE-2026-124036.json +++ b/data/2026/CVE-2026-124036.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"FlockOS","vendor":"Flock","versions":[{"lessThan":"2026-09-28","status":"affected","version":"0","versionType":"date"}]}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552"}],"cveTags":[{"sourceIdentifier":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to manage saved searches in their own organization to read, modify or delete another organization's saved-search alerts and change their recipients, given the alert's identifier, and to create alerts attributed to another organization. Flock remediated the issue in the hosted service on 2026-09-28; no customer action is required."}],"id":"CVE-2026-124036","lastModified":"2026-11-11T05:19:35.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.5,"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T16:17:18.630","references":[{"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","url":"https://www.flocksafety.com/legal/security-advisories"}],"sourceIdentifier":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"FlockOS","vendor":"Flock","versions":[{"lessThan":"2026-09-28","status":"affected","version":"0","versionType":"date"}]}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552"}],"cveTags":[{"sourceIdentifier":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, prior to 2026-09-28, allowed an authenticated user with permission to manage saved searches in their own organization to read, modify or delete another organization's saved-search alerts and change their recipients, given the alert's identifier, and to create alerts attributed to another organization. Flock remediated the issue in the hosted service on 2026-09-28; no customer action is required."}],"id":"CVE-2026-124036","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.5,"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T16:17:18.630","references":[{"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","url":"https://www.flocksafety.com/legal/security-advisories"}],"sourceIdentifier":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124037.json b/data/2026/CVE-2026-124037.json index ae336d4964..c9d0d0bf9c 100644 --- a/data/2026/CVE-2026-124037.json +++ b/data/2026/CVE-2026-124037.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Flock Safety Platform","vendor":"Flock","versions":[{"lessThan":"2026-10-22","status":"affected","version":"2026-06-23","versionType":"date"}]}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552"}],"cveTags":[{"sourceIdentifier":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22, allowed a remote, unauthenticated attacker who had a community's public sign-up link and a registered vehicle's license plate to retrieve that registrant's name, email address, home address and approval status. Each lookup required solving a CAPTCHA. No license plate reader detections, images or video were exposed. Flock remediated the issue in the hosted service on 2026-10-22; no customer action is required."}],"id":"CVE-2026-124037","lastModified":"2026-11-10T17:17:24.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124037","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:27:43.651817Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:18.800","references":[{"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","url":"https://www.flocksafety.com/legal/security-advisories"}],"sourceIdentifier":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-359"}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Flock Safety Platform","vendor":"Flock","versions":[{"lessThan":"2026-10-22","status":"affected","version":"2026-06-23","versionType":"date"}]}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552"}],"cveTags":[{"sourceIdentifier":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22, allowed a remote, unauthenticated attacker who had a community's public sign-up link and a registered vehicle's license plate to retrieve that registrant's name, email address, home address and approval status. Each lookup required solving a CAPTCHA. No license plate reader detections, images or video were exposed. Flock remediated the issue in the hosted service on 2026-10-22; no customer action is required."}],"id":"CVE-2026-124037","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124037","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:27:43.651817Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:18.800","references":[{"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","url":"https://www.flocksafety.com/legal/security-advisories"}],"sourceIdentifier":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-359"}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124038.json b/data/2026/CVE-2026-124038.json index 1e8509ba70..018d648660 100644 --- a/data/2026/CVE-2026-124038.json +++ b/data/2026/CVE-2026-124038.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:flocksafety:flock_installer_app:*:*:*:*:*:android:*:*"],"defaultStatus":"unaffected","platforms":["Android"],"product":"Flock Installer app","vendor":"Flock","versions":[{"lessThan":"2.35.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later."}],"id":"CVE-2026-124038","lastModified":"2026-11-10T17:17:24.927","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":0.9,"impactScore":1.4,"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":1.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124038","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:35:26.493160Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:18.957","references":[{"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","url":"https://www.flocksafety.com/legal/security-advisories"}],"sourceIdentifier":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-776"}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:flocksafety:flock_installer_app:*:*:*:*:*:android:*:*"],"defaultStatus":"unaffected","platforms":["Android"],"product":"Flock Installer app","vendor":"Flock","versions":[{"lessThan":"2.35.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a camera configuration response that contains nested XML entity declarations. The vulnerability does not allow the attacker to read or change data on the device, and no customer license plate, video or location data is exposed. Android 13 and later reject the response. The issue is fixed in version 2.35.0; update to 2.35.0 or later."}],"id":"CVE-2026-124038","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":2.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":0.9,"impactScore":1.4,"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":1.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124038","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:35:26.493160Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:18.957","references":[{"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","url":"https://www.flocksafety.com/legal/security-advisories"}],"sourceIdentifier":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-776"}],"source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124077.json b/data/2026/CVE-2026-124077.json index c00de69e18..81bbc6e918 100644 --- a/data/2026/CVE-2026-124077.json +++ b/data/2026/CVE-2026-124077.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"commons-codec:commons-codec","packageURL":"pkg:maven/commons-codec/commons-codec","product":"Apache Commons Codec","vendor":"Apache Software Foundation","versions":[{"lessThan":"1.23.0","status":"affected","version":"1.22.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"Apache Commons Codec","repo":"https://gitbox.apache.org/repos/asf/commons-codec.git","vendor":"Apache Software Foundation","versions":[{"lessThan":"87f6aa2818836998528ff4b0d1ea35545a800ee5","status":"affected","version":"387120c901f4a75c3112dfdf8877dcdec7ae685d","versionType":"git"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.\n\n\n\nThe impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.\n\n\n\nThis issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.\n\n\n\nUsers are recommended to upgrade to version 1.23.0, which fixes the issue."}],"id":"CVE-2026-124077","lastModified":"2026-11-10T01:17:17.943","metrics":{},"published":"2026-11-09T20:18:10.340","references":[{"source":"security@apache.org","url":"https://github.com/apache/commons-codec/commit/87f6aa2818836998528ff4b0d1ea35545a800ee5.patch"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/zns7tbnkq685prps9d85q7ct6oobvzsm"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/30"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-158"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"commons-codec:commons-codec","packageURL":"pkg:maven/commons-codec/commons-codec","product":"Apache Commons Codec","vendor":"Apache Software Foundation","versions":[{"lessThan":"1.23.0","status":"affected","version":"1.22.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"Apache Commons Codec","repo":"https://gitbox.apache.org/repos/asf/commons-codec.git","vendor":"Apache Software Foundation","versions":[{"lessThan":"87f6aa2818836998528ff4b0d1ea35545a800ee5","status":"affected","version":"387120c901f4a75c3112dfdf8877dcdec7ae685d","versionType":"git"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could then receive the same Git tree identifier or SWHID.\n\n\n\nThe impact is limited: common file systems do not allow NUL bytes in file names, so trees built by walking a file system are not affected. Only applications that build trees from names supplied by other sources, such as entries of archive formats that permit NUL bytes in names (e.g. ZIP) or names passed directly to the API, are exposed.\n\n\n\nThis issue affects Apache Commons Codec: from 1.22.0 before 1.23.0.\n\n\n\nUsers are recommended to upgrade to version 1.23.0, which fixes the issue."}],"id":"CVE-2026-124077","lastModified":"2026-11-12T18:17:21.317","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:33:11.359032Z","version":"2.0.3"}}]},"published":"2026-11-09T20:18:10.340","references":[{"source":"security@apache.org","url":"https://github.com/apache/commons-codec/commit/87f6aa2818836998528ff4b0d1ea35545a800ee5.patch"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/zns7tbnkq685prps9d85q7ct6oobvzsm"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/30"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-158"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124249.json b/data/2026/CVE-2026-124249.json index a5ad747eac..5b63949d41 100644 --- a/data/2026/CVE-2026-124249.json +++ b/data/2026/CVE-2026-124249.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["http","http.cookiejar"],"product":"CPython","repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","versions":[{"lessThan":"3.16.0a2","status":"affected","version":"0","versionType":"python"}]}],"source":"cna@python.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"http.cookiejar.CookieJar deleted a stored cookie when a response carried an\nalready expired Set-Cookie header for it, using the Domain and Path\nattributes from the header without consulting the cookie policy. A server\ncould therefore delete cookies belonging to other domains from a shared\ncookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix\nconsults the cookie policy before an expired cookie may delete an existing\none, as required by RFC 6265 section 5.3."}],"id":"CVE-2026-124249","lastModified":"2026-11-11T01:17:13.863","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@python.org","type":"Secondary"}]},"published":"2026-11-09T15:17:14.963","references":[{"source":"cna@python.org","url":"https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643"},{"source":"cna@python.org","url":"https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494"},{"source":"cna@python.org","url":"https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73"},{"source":"cna@python.org","url":"https://github.com/python/cpython/issues/161569"},{"source":"cna@python.org","url":"https://github.com/python/cpython/pull/161570"},{"source":"cna@python.org","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/24"}],"sourceIdentifier":"cna@python.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"cna@python.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["http","http.cookiejar"],"product":"CPython","repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","versions":[{"lessThan":"3.16.0a2","status":"affected","version":"0","versionType":"python"}]}],"source":"cna@python.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"http.cookiejar.CookieJar deleted a stored cookie when a response carried an\nalready expired Set-Cookie header for it, using the Domain and Path\nattributes from the header without consulting the cookie policy. A server\ncould therefore delete cookies belonging to other domains from a shared\ncookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix\nconsults the cookie policy before an expired cookie may delete an existing\none, as required by RFC 6265 section 5.3."}],"id":"CVE-2026-124249","lastModified":"2026-11-12T17:17:30.290","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@python.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124249","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:23:30.385286Z","version":"2.0.3"}}]},"published":"2026-11-09T15:17:14.963","references":[{"source":"cna@python.org","url":"https://github.com/python/cpython/commit/4e9d037f1cfc8e29efcb1f67bc668e06ff2b6643"},{"source":"cna@python.org","url":"https://github.com/python/cpython/commit/8eb3d2c1c41ca7ce628554413981c1eb763a1494"},{"source":"cna@python.org","url":"https://github.com/python/cpython/commit/ac1d49f4fbb33941475c5aa3cb663ab39d64cb73"},{"source":"cna@python.org","url":"https://github.com/python/cpython/issues/161569"},{"source":"cna@python.org","url":"https://github.com/python/cpython/pull/161570"},{"source":"cna@python.org","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/Y6IKNZ2VZUS2L6CLQICSFUEMCLT7OLTY/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/24"}],"sourceIdentifier":"cna@python.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"cna@python.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124310.json b/data/2026/CVE-2026-124310.json index ec76cf4605..79d5f8b0fa 100644 --- a/data/2026/CVE-2026-124310.json +++ b/data/2026/CVE-2026-124310.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/fraunhoferhhi/vvdec","product":"vvdec","repo":"https://github.com/fraunhoferhhi/vvdec","vendor":"fraunhoferhhi","versions":[{"lessThan":"3.2.1","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.2.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying bitstreams with overlapping slice CTU coverage. Attackers can code a CTU in a second slice so a bi-predicted BDOF coding unit carries a negative reference index, causing Slice::getRefPic to read outside m_apcRefPicList and crash decoding."}],"id":"CVE-2026-124310","lastModified":"2026-11-11T19:17:35.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124310","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:24:28.210262Z","version":"2.0.3"}}]},"published":"2026-11-07T15:17:14.827","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/InterPrediction.cpp#L609-L631"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/Slice.h#L2645"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec/commit/32b842c10bf024f09bc7cf1445fa6f8a987422ca"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec/commit/6e4b907ef5ab9db390b1293ba1ad5d7dd0a67e3f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec/issues/402"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-out-of-bounds-read-via-slice-getrefpic"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/24"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/fraunhoferhhi/vvdec/issues/402"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/fraunhoferhhi/vvdec","product":"vvdec","repo":"https://github.com/fraunhoferhhi/vvdec","vendor":"fraunhoferhhi","versions":[{"lessThan":"3.2.1","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.2.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying bitstreams with overlapping slice CTU coverage. Attackers can code a CTU in a second slice so a bi-predicted BDOF coding unit carries a negative reference index, causing Slice::getRefPic to read outside m_apcRefPicList and crash decoding."}],"id":"CVE-2026-124310","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124310","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:24:28.210262Z","version":"2.0.3"}}]},"published":"2026-11-07T15:17:14.827","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/InterPrediction.cpp#L609-L631"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec/blob/v3.2.0/source/Lib/CommonLib/Slice.h#L2645"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec/commit/32b842c10bf024f09bc7cf1445fa6f8a987422ca"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec/commit/6e4b907ef5ab9db390b1293ba1ad5d7dd0a67e3f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fraunhoferhhi/vvdec/issues/402"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/fraunhofer-hhi-vvdec-before-3.2.1-out-of-bounds-read-via-slice-getrefpic"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/24"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/fraunhoferhhi/vvdec/issues/402"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124328.json b/data/2026/CVE-2026-124328.json index c422b05f76..68c7d50597 100644 --- a/data/2026/CVE-2026-124328.json +++ b/data/2026/CVE-2026-124328.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:flowci:flow-core-x:*:*:*:*:*:*:*:*"],"modules":["Groovy Script Evaluation"],"product":"flow-core-x","vendor":"FlowCI","versions":[{"status":"affected","version":"1.23.0"},{"status":"affected","version":"1.23.1"},{"status":"affected","version":"1.23.2"},{"status":"affected","version":"1.23.3"},{"status":"affected","version":"1.23.4"},{"status":"affected","version":"1.23.5"},{"status":"affected","version":"1.23.6"},{"status":"affected","version":"1.23.7"},{"status":"affected","version":"1.23.8"},{"status":"affected","version":"1.23.9"},{"status":"affected","version":"1.23.10"},{"status":"affected","version":"1.23.11"},{"status":"affected","version":"1.23.12"},{"status":"affected","version":"1.23.13"},{"status":"affected","version":"1.23.14"},{"status":"affected","version":"1.23.15"},{"status":"affected","version":"1.23.16"},{"status":"affected","version":"1.23.17"},{"status":"affected","version":"1.23.18"},{"status":"affected","version":"1.23.19"},{"status":"affected","version":"1.23.20"},{"status":"affected","version":"1.23.21"},{"status":"affected","version":"1.23.22"},{"status":"affected","version":"1.23.23"},{"status":"affected","version":"1.23.24"},{"status":"affected","version":"1.23.25"},{"status":"affected","version":"1.23.26"},{"status":"affected","version":"1.23.27"},{"status":"affected","version":"1.23.28"},{"status":"affected","version":"1.23.29"},{"status":"affected","version":"1.23.30"},{"status":"affected","version":"1.23.31"},{"status":"affected","version":"1.23.32"},{"status":"affected","version":"1.23.33"},{"status":"affected","version":"1.23.34"},{"status":"affected","version":"1.23.35"},{"status":"affected","version":"1.23.36"},{"status":"affected","version":"1.23.37"},{"status":"affected","version":"1.23.38"},{"status":"affected","version":"1.23.39"},{"status":"affected","version":"1.23.40"},{"status":"affected","version":"1.23.41"},{"status":"affected","version":"1.23.42"},{"status":"affected","version":"1.23.43"},{"status":"affected","version":"1.23.44"},{"status":"affected","version":"1.23.45"},{"status":"affected","version":"1.23.46"},{"status":"affected","version":"1.23.47"},{"status":"affected","version":"1.23.48"},{"status":"affected","version":"1.23.49"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of the argument condition leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-124328","lastModified":"2026-11-08T11:16:34.733","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":6.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":3.7,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-08T11:16:34.420","references":[{"source":"cna@vuldb.com","url":"https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124328"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1027401"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432648"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432648/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:flowci:flow-core-x:*:*:*:*:*:*:*:*"],"modules":["Groovy Script Evaluation"],"product":"flow-core-x","vendor":"FlowCI","versions":[{"status":"affected","version":"1.23.0"},{"status":"affected","version":"1.23.1"},{"status":"affected","version":"1.23.2"},{"status":"affected","version":"1.23.3"},{"status":"affected","version":"1.23.4"},{"status":"affected","version":"1.23.5"},{"status":"affected","version":"1.23.6"},{"status":"affected","version":"1.23.7"},{"status":"affected","version":"1.23.8"},{"status":"affected","version":"1.23.9"},{"status":"affected","version":"1.23.10"},{"status":"affected","version":"1.23.11"},{"status":"affected","version":"1.23.12"},{"status":"affected","version":"1.23.13"},{"status":"affected","version":"1.23.14"},{"status":"affected","version":"1.23.15"},{"status":"affected","version":"1.23.16"},{"status":"affected","version":"1.23.17"},{"status":"affected","version":"1.23.18"},{"status":"affected","version":"1.23.19"},{"status":"affected","version":"1.23.20"},{"status":"affected","version":"1.23.21"},{"status":"affected","version":"1.23.22"},{"status":"affected","version":"1.23.23"},{"status":"affected","version":"1.23.24"},{"status":"affected","version":"1.23.25"},{"status":"affected","version":"1.23.26"},{"status":"affected","version":"1.23.27"},{"status":"affected","version":"1.23.28"},{"status":"affected","version":"1.23.29"},{"status":"affected","version":"1.23.30"},{"status":"affected","version":"1.23.31"},{"status":"affected","version":"1.23.32"},{"status":"affected","version":"1.23.33"},{"status":"affected","version":"1.23.34"},{"status":"affected","version":"1.23.35"},{"status":"affected","version":"1.23.36"},{"status":"affected","version":"1.23.37"},{"status":"affected","version":"1.23.38"},{"status":"affected","version":"1.23.39"},{"status":"affected","version":"1.23.40"},{"status":"affected","version":"1.23.41"},{"status":"affected","version":"1.23.42"},{"status":"affected","version":"1.23.43"},{"status":"affected","version":"1.23.44"},{"status":"affected","version":"1.23.45"},{"status":"affected","version":"1.23.46"},{"status":"affected","version":"1.23.47"},{"status":"affected","version":"1.23.48"},{"status":"affected","version":"1.23.49"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of the argument condition leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-124328","lastModified":"2026-11-12T19:16:52.057","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":6.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":3.7,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124328","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:04:12.239715Z","version":"2.0.3"}}]},"published":"2026-11-08T11:16:34.420","references":[{"source":"cna@vuldb.com","url":"https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124328"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1027401"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432648"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432648/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124408.json b/data/2026/CVE-2026-124408.json index c0eb19b7f6..01b82291c8 100644 --- a/data/2026/CVE-2026-124408.json +++ b/data/2026/CVE-2026-124408.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wp-cafe","product":"WPCafe","vendor":"Arraytics","versions":[{"changes":[{"at":"3.0.23","status":"unaffected"}],"lessThanOrEqual":"3.0.22","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22."}],"id":"CVE-2026-124408","lastModified":"2026-11-11T12:19:47.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-11T12:19:47.040","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-3-0-22-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wp-cafe","product":"WPCafe","vendor":"Arraytics","versions":[{"changes":[{"at":"3.0.23","status":"unaffected"}],"lessThanOrEqual":"3.0.22","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22."}],"id":"CVE-2026-124408","lastModified":"2026-11-12T19:16:52.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T15:00:19.755027Z","version":"2.0.3"}}]},"published":"2026-11-11T12:19:47.040","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-3-0-22-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124422.json b/data/2026/CVE-2026-124422.json index b2a3166596..102a6e69e5 100644 --- a/data/2026/CVE-2026-124422.json +++ b/data/2026/CVE-2026-124422.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/suneditor","product":"suneditor","repo":"https://github.com/JiHong88/suneditor","vendor":"jihong88","versions":[{"lessThan":"3.4.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content."}],"id":"CVE-2026-124422","lastModified":"2026-11-10T18:17:28.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124422","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:29:37.766796Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:57.460","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/blob/3.3.3/src/core/logic/dom/html.js#L336-L350"},{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/commit/57db24ac218cd10942fed0bb8288e9cb40b334bb"},{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/releases/tag/3.4.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-q867-q2hw-f8gp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/suneditor-3.0.0-before-3.4.0-stored-xss-via-html-clean-iframe-placeholder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/suneditor","product":"suneditor","repo":"https://github.com/JiHong88/suneditor","vendor":"jihong88","versions":[{"lessThan":"3.4.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute script in the host page origin when victims load or paste the content."}],"id":"CVE-2026-124422","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124422","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:29:37.766796Z","version":"2.0.3"}}]},"published":"2026-11-08T02:16:57.460","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/blob/3.3.3/src/core/logic/dom/html.js#L336-L350"},{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/commit/57db24ac218cd10942fed0bb8288e9cb40b334bb"},{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/releases/tag/3.4.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-q867-q2hw-f8gp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/suneditor-3.0.0-before-3.4.0-stored-xss-via-html-clean-iframe-placeholder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124426.json b/data/2026/CVE-2026-124426.json index 0c173632d3..798e67234d 100644 --- a/data/2026/CVE-2026-124426.json +++ b/data/2026/CVE-2026-124426.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"cms","vendor":"craftcms","versions":[{"lessThan":"5.11.2","status":"affected","version":"5.0.0","versionType":"semver"},{"status":"unaffected","version":"5.11.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content."}],"id":"CVE-2026-124426","lastModified":"2026-11-10T21:46:29.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T14:18:08.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/craftcms/cms/security/advisories/GHSA-mp59-9rf5-93wr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/craft-cms-before-5.11.2-graphql-sites-scope-bypass-via-localized-field"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"cms","vendor":"craftcms","versions":[{"lessThan":"5.11.2","status":"affected","version":"5.0.0","versionType":"semver"},{"status":"unaffected","version":"5.11.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content."}],"id":"CVE-2026-124426","lastModified":"2026-11-12T19:16:52.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124426","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:07:29.787161Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:08.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/craftcms/cms/security/advisories/GHSA-mp59-9rf5-93wr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/craft-cms-before-5.11.2-graphql-sites-scope-bypass-via-localized-field"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124427.json b/data/2026/CVE-2026-124427.json index cdb94c4877..dad29b0db0 100644 --- a/data/2026/CVE-2026-124427.json +++ b/data/2026/CVE-2026-124427.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"cms","vendor":"craftcms","versions":[{"lessThan":"5.11.2","status":"affected","version":"5.0.0","versionType":"semver"},{"status":"unaffected","version":"5.11.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections."}],"id":"CVE-2026-124427","lastModified":"2026-11-10T21:46:29.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T14:18:08.517","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/craftcms/cms/security/advisories/GHSA-xpg7-m6gm-4xfh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.2-graphql-schema-scope-bypass-via-prev-next"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"cms","vendor":"craftcms","versions":[{"lessThan":"5.11.2","status":"affected","version":"5.0.0","versionType":"semver"},{"status":"unaffected","version":"5.11.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections."}],"id":"CVE-2026-124427","lastModified":"2026-11-12T19:16:52.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124427","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:53:12.358793Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:08.517","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/craftcms/cms/security/advisories/GHSA-xpg7-m6gm-4xfh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.2-graphql-schema-scope-bypass-via-prev-next"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124430.json b/data/2026/CVE-2026-124430.json index 221c6dbf8d..93e4ea1ea8 100644 --- a/data/2026/CVE-2026-124430.json +++ b/data/2026/CVE-2026-124430.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"cms","vendor":"craftcms","versions":[{"lessThan":"5.11.2","status":"affected","version":"5.10.0","versionType":"semver"},{"status":"unaffected","version":"5.11.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker."}],"id":"CVE-2026-124430","lastModified":"2026-11-10T21:46:24.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T14:18:08.990","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/craftcms/cms/security/advisories/GHSA-qj3q-j7r4-428p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/craft-cms-5.10.0-before-5.11.2-rce-via-app-render-elements-signing-oracle"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1336"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"cms","vendor":"craftcms","versions":[{"lessThan":"5.11.2","status":"affected","version":"5.10.0","versionType":"semver"},{"status":"unaffected","version":"5.11.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker."}],"id":"CVE-2026-124430","lastModified":"2026-11-12T20:18:26.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124430","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:11:28.816253Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:08.990","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/craftcms/cms/security/advisories/GHSA-qj3q-j7r4-428p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/craft-cms-5.10.0-before-5.11.2-rce-via-app-render-elements-signing-oracle"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1336"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124434.json b/data/2026/CVE-2026-124434.json index d8e270ad4a..d8dcfe3bfd 100644 --- a/data/2026/CVE-2026-124434.json +++ b/data/2026/CVE-2026-124434.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"grav","vendor":"getgrav","versions":[{"lessThan":"1.3.2","status":"affected","version":"1.1.0","versionType":"semver"},{"status":"unaffected","version":"1.3.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page."}],"id":"CVE-2026-124434","lastModified":"2026-11-08T14:18:09.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T14:18:09.663","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/getgrav/grav/security/advisories/GHSA-jq4h-4q3q-hr32"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/grav-lightbox-gallery-1.1.0-before-1.3.2-file-read-via-shortcode-media-actions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"grav","vendor":"getgrav","versions":[{"lessThan":"1.3.2","status":"affected","version":"1.1.0","versionType":"semver"},{"status":"unaffected","version":"1.3.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page."}],"id":"CVE-2026-124434","lastModified":"2026-11-12T20:18:27.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124434","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:13:57.545939Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:09.663","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/getgrav/grav/security/advisories/GHSA-jq4h-4q3q-hr32"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/grav-lightbox-gallery-1.1.0-before-1.3.2-file-read-via-shortcode-media-actions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124438.json b/data/2026/CVE-2026-124438.json index 7862e7be56..a7db9b1200 100644 --- a/data/2026/CVE-2026-124438.json +++ b/data/2026/CVE-2026-124438.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:nuget/Scriban","product":"scriban","vendor":"scriban","versions":[{"lessThan":"7.5.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"7.5.2","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:nuget/Scriban.Signed","product":"scriban","vendor":"scriban","versions":[{"lessThan":"7.5.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"7.5.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths."}],"id":"CVE-2026-124438","lastModified":"2026-11-08T14:18:10.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T14:18:10.320","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/scriban/scriban/security/advisories/GHSA-hvr4-4p37-494f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scriban-before-7.5.2-delegate-target-exposure-via-array-map-member-access"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:nuget/Scriban","product":"scriban","vendor":"scriban","versions":[{"lessThan":"7.5.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"7.5.2","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:nuget/Scriban.Signed","product":"scriban","vendor":"scriban","versions":[{"lessThan":"7.5.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"7.5.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths."}],"id":"CVE-2026-124438","lastModified":"2026-11-12T20:18:27.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124438","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:24:47.966815Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:10.320","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/scriban/scriban/security/advisories/GHSA-hvr4-4p37-494f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scriban-before-7.5.2-delegate-target-exposure-via-array-map-member-access"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/scriban/scriban/security/advisories/GHSA-hvr4-4p37-494f"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124439.json b/data/2026/CVE-2026-124439.json index 9b14c03898..e892c0c32c 100644 --- a/data/2026/CVE-2026-124439.json +++ b/data/2026/CVE-2026-124439.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:nuget/Scriban","product":"scriban","vendor":"scriban","versions":[{"lessThan":"7.5.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"7.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:nuget/Scriban.Signed","product":"scriban","vendor":"scriban","versions":[{"lessThan":"7.5.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"7.5.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process."}],"id":"CVE-2026-124439","lastModified":"2026-11-10T18:17:28.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124439","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:29:40.071556Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:10.470","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/scriban/scriban/security/advisories/GHSA-mvmw-9jxc-7pr2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-uncatchable-stackoverflowexception"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:nuget/Scriban","product":"scriban","vendor":"scriban","versions":[{"lessThan":"7.5.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"7.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:nuget/Scriban.Signed","product":"scriban","vendor":"scriban","versions":[{"lessThan":"7.5.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"7.5.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process."}],"id":"CVE-2026-124439","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124439","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:29:40.071556Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:10.470","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/scriban/scriban/security/advisories/GHSA-mvmw-9jxc-7pr2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-uncatchable-stackoverflowexception"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124442.json b/data/2026/CVE-2026-124442.json index 5767fa4ffc..4498591ee5 100644 --- a/data/2026/CVE-2026-124442.json +++ b/data/2026/CVE-2026-124442.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AzuraCast","vendor":"AzuraCast","versions":[{"lessThan":"0.24.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"0.24.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL, causing the Guzzle client to reach internal services and expose responses via test logs."}],"id":"CVE-2026-124442","lastModified":"2026-11-08T14:18:11.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T14:18:10.957","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connector-redirects"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AzuraCast","vendor":"AzuraCast","versions":[{"lessThan":"0.24.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"0.24.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL, causing the Guzzle client to reach internal services and expose responses via test logs."}],"id":"CVE-2026-124442","lastModified":"2026-11-12T20:18:27.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124442","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:25:44.887322Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:10.957","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/azuracast-before-0.24.0-ssrf-filter-bypass-via-webhook-connector-redirects"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-3mcm-xm6c-fj44"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124446.json b/data/2026/CVE-2026-124446.json index 13e1c43a1e..d953caacba 100644 --- a/data/2026/CVE-2026-124446.json +++ b/data/2026/CVE-2026-124446.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path parameter. Attackers can request action=download to retrieve cleartext files like sqlconf.php database credentials and keys, or use action=setup to overwrite web-server-writable files with ciphertext."}],"id":"CVE-2026-124446","lastModified":"2026-11-10T21:46:24.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T14:18:11.650","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-x2vr-jgg8-c57c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-arbitrary-file-read-and-write-via-faxsms-disposedocument"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path parameter. Attackers can request action=download to retrieve cleartext files like sqlconf.php database credentials and keys, or use action=setup to overwrite web-server-writable files with ciphertext."}],"id":"CVE-2026-124446","lastModified":"2026-11-12T20:18:27.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124446","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:26:50.994762Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:11.650","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-x2vr-jgg8-c57c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-arbitrary-file-read-and-write-via-faxsms-disposedocument"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/openemr/openemr/security/advisories/GHSA-x2vr-jgg8-c57c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124450.json b/data/2026/CVE-2026-124450.json index fa2a6b6717..220a99f945 100644 --- a/data/2026/CVE-2026-124450.json +++ b/data/2026/CVE-2026-124450.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution."}],"id":"CVE-2026-124450","lastModified":"2026-11-10T21:46:29.607","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T14:18:12.260","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wf4w-mx2w-j4vv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-arbitrary-file-read-write-via-disposedocument"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution."}],"id":"CVE-2026-124450","lastModified":"2026-11-12T20:18:28.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124450","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:27:56.472718Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:12.260","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wf4w-mx2w-j4vv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-arbitrary-file-read-write-via-disposedocument"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wf4w-mx2w-j4vv"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124455.json b/data/2026/CVE-2026-124455.json index 9ebe2e9168..bc08d86b39 100644 --- a/data/2026/CVE-2026-124455.json +++ b/data/2026/CVE-2026-124455.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other patients' documents by overriding Pid_Equals criteria. Attackers can supply Pid_Equals, Pid_GreaterThan, or Pid_In request parameters to the onsitedocuments API to retrieve signed consent forms, signatures, and PHI of any patient."}],"id":"CVE-2026-124455","lastModified":"2026-11-10T21:46:24.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T14:18:12.943","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hvp7-q2hp-6j6g"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-via-portal-onsitedocument-pid-equals-mass-assignment"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other patients' documents by overriding Pid_Equals criteria. Attackers can supply Pid_Equals, Pid_GreaterThan, or Pid_In request parameters to the onsitedocuments API to retrieve signed consent forms, signatures, and PHI of any patient."}],"id":"CVE-2026-124455","lastModified":"2026-11-12T20:18:28.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124455","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:34:36.778532Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:12.943","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hvp7-q2hp-6j6g"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-idor-via-portal-onsitedocument-pid-equals-mass-assignment"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hvp7-q2hp-6j6g"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124459.json b/data/2026/CVE-2026-124459.json index 82e404daa4..d6fca04a69 100644 --- a/data/2026/CVE-2026-124459.json +++ b/data/2026/CVE-2026-124459.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read and overwrite other patients' clinical records."}],"id":"CVE-2026-124459","lastModified":"2026-11-10T21:46:40.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-08T14:18:13.550","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3mg9-27fw-m9j6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-cross-patient-idor-via-encounter-form-viewers-and-save-handlers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.3.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read and overwrite other patients' clinical records."}],"id":"CVE-2026-124459","lastModified":"2026-11-12T20:18:28.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124459","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:38:59.574731Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:13.550","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3mg9-27fw-m9j6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.3.0-cross-patient-idor-via-encounter-form-viewers-and-save-handlers"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3mg9-27fw-m9j6"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124493.json b/data/2026/CVE-2026-124493.json index a9743a9474..3d94dd51df 100644 --- a/data/2026/CVE-2026-124493.json +++ b/data/2026/CVE-2026-124493.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"suneditor","vendor":"JiHong88","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.4.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft."}],"id":"CVE-2026-124493","lastModified":"2026-11-12T14:17:28.280","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124493","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:11:31.348805Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:19.130","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-documenttype-header-textcontent"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfh"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"suneditor","vendor":"JiHong88","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.4.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft."}],"id":"CVE-2026-124493","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124493","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:11:31.348805Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:19.130","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-documenttype-header-textcontent"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-h9pq-57qf-vvfh"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124494.json b/data/2026/CVE-2026-124494.json index 8afe3c3f55..c6aace826a 100644 --- a/data/2026/CVE-2026-124494.json +++ b/data/2026/CVE-2026-124494.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/suneditor","product":"suneditor","vendor":"JiHong88","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.4.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links."}],"id":"CVE-2026-124494","lastModified":"2026-11-10T18:17:30.787","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124494","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:26:18.573220Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:19.277","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/suneditor","product":"suneditor","vendor":"JiHong88","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.4.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links."}],"id":"CVE-2026-124494","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124494","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:26:18.573220Z","version":"2.0.3"}}]},"published":"2026-11-08T14:18:19.277","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-v4jx-8pj6-w4w8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-colon-entity-sanitizer-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124495.json b/data/2026/CVE-2026-124495.json index 11507b53b5..630365423b 100644 --- a/data/2026/CVE-2026-124495.json +++ b/data/2026/CVE-2026-124495.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-webapp","packageURL":"pkg:maven/org.apache.storm/storm-webapp","product":"Apache Storm","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.2.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue."}],"id":"CVE-2026-124495","lastModified":"2026-11-11T19:17:35.497","metrics":{},"published":"2026-11-11T13:17:19.613","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/q4xbld4n4v14t8d74vb342skx8d0mzz8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/4"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-webapp","packageURL":"pkg:maven/org.apache.storm/storm-webapp","product":"Apache Storm","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.2.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue."}],"id":"CVE-2026-124495","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-11T13:17:19.613","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/q4xbld4n4v14t8d74vb342skx8d0mzz8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/4"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124496.json b/data/2026/CVE-2026-124496.json index 062b49b551..a12e895b08 100644 --- a/data/2026/CVE-2026-124496.json +++ b/data/2026/CVE-2026-124496.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-server","packageURL":"pkg:maven/org.apache.storm/storm-server","product":"Apache Storm","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.2.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue."}],"id":"CVE-2026-124496","lastModified":"2026-11-11T19:17:35.630","metrics":{},"published":"2026-11-11T13:17:19.750","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/z8r5mxcpfgklq820j8krk8ozqxgqdhtr"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/5"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-server","packageURL":"pkg:maven/org.apache.storm/storm-server","product":"Apache Storm","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.2.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue."}],"id":"CVE-2026-124496","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-11T13:17:19.750","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/z8r5mxcpfgklq820j8krk8ozqxgqdhtr"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/5"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124502.json b/data/2026/CVE-2026-124502.json index 014e58c786..333197bd90 100644 --- a/data/2026/CVE-2026-124502.json +++ b/data/2026/CVE-2026-124502.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:yungifez:skuul_school_management_system:*:*:*:*:*:*:*:*"],"modules":["Delete Handler"],"product":"Skuul School Management System","vendor":"yungifez","versions":[{"status":"affected","version":"2.6.0"},{"status":"affected","version":"2.6.1"},{"status":"affected","version":"2.6.2"},{"status":"affected","version":"2.6.3"},{"status":"unaffected","version":"3.0.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded."}],"id":"CVE-2026-124502","lastModified":"2026-11-09T00:18:01.783","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":4.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-09T00:18:01.620","references":[{"source":"cna@vuldb.com","url":"https://gist.github.com/mrvirus2006/94d6e1ed1d6cd9ddf6412c734a76243d"},{"source":"cna@vuldb.com","url":"https://github.com/yungifez/skuul/commit/b42f2c80a8e5e01ca6e607bbd97f137ede368ac9"},{"source":"cna@vuldb.com","url":"https://github.com/yungifez/skuul/pull/433"},{"source":"cna@vuldb.com","url":"https://github.com/yungifez/skuul/releases/tag/v3.0.0"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124502"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1034853"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432807"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432807/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-863"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:yungifez:skuul_school_management_system:*:*:*:*:*:*:*:*"],"modules":["Delete Handler"],"product":"Skuul School Management System","vendor":"yungifez","versions":[{"status":"affected","version":"2.6.0"},{"status":"affected","version":"2.6.1"},{"status":"affected","version":"2.6.2"},{"status":"affected","version":"2.6.3"},{"status":"unaffected","version":"3.0.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded."}],"id":"CVE-2026-124502","lastModified":"2026-11-12T20:18:29.060","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":4.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124502","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:43:48.646311Z","version":"2.0.3"}}]},"published":"2026-11-09T00:18:01.620","references":[{"source":"cna@vuldb.com","url":"https://gist.github.com/mrvirus2006/94d6e1ed1d6cd9ddf6412c734a76243d"},{"source":"cna@vuldb.com","url":"https://github.com/yungifez/skuul/commit/b42f2c80a8e5e01ca6e607bbd97f137ede368ac9"},{"source":"cna@vuldb.com","url":"https://github.com/yungifez/skuul/pull/433"},{"source":"cna@vuldb.com","url":"https://github.com/yungifez/skuul/releases/tag/v3.0.0"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124502"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1034853"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432807"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432807/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-863"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124577.json b/data/2026/CVE-2026-124577.json index 3518e3d594..f9670a9860 100644 --- a/data/2026/CVE-2026-124577.json +++ b/data/2026/CVE-2026-124577.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:intelbras:sg_2404_poe_l2_:*:*:*:*:*:*:*:*"],"modules":["Web Management Interface"],"product":"SG 2404 PoE L2+","vendor":"Intelbras","versions":[{"status":"affected","version":"1.00.70"},{"status":"affected","version":"1.00.72"},{"status":"unaffected","version":"1.00.74"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.00.74 is sufficient to fix this issue. Upgrading the affected component is advised."}],"id":"CVE-2026-124577","lastModified":"2026-11-09T08:17:02.497","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":10.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":10.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-09T08:17:02.350","references":[{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124577"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1038184"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432923"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432923/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:intelbras:sg_2404_poe_l2_:*:*:*:*:*:*:*:*"],"modules":["Web Management Interface"],"product":"SG 2404 PoE L2+","vendor":"Intelbras","versions":[{"status":"affected","version":"1.00.70"},{"status":"affected","version":"1.00.72"},{"status":"unaffected","version":"1.00.74"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.00.74 is sufficient to fix this issue. Upgrading the affected component is advised."}],"id":"CVE-2026-124577","lastModified":"2026-11-12T19:16:52.700","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":10.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":10.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124577","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:53:15.844825Z","version":"2.0.3"}}]},"published":"2026-11-09T08:17:02.350","references":[{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124577"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1038184"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432923"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432923/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124580.json b/data/2026/CVE-2026-124580.json index 186ed087e5..b9cd8fea05 100644 --- a/data/2026/CVE-2026-124580.json +++ b/data/2026/CVE-2026-124580.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:chengdu_feiyuxing_technology:vw2100:*:*:*:*:*:*:*:*"],"modules":["Weixin Auth Endpoint"],"product":"VW2100","vendor":"Chengdu Feiyuxing Technology","versions":[{"status":"affected","version":"1.0 B-MB3W202-210825-r11775"}]},{"cpes":["cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp:*:*:*:*:*:*:*:*"],"modules":["Weixin Auth Endpoint"],"product":"VEC10GP","vendor":"Chengdu Feiyuxing Technology","versions":[{"status":"affected","version":"1.0 B-MB3W202-210825-r11775"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-124580","lastModified":"2026-11-09T08:17:03.070","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":10.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":10.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-09T08:17:02.923","references":[{"source":"cna@vuldb.com","url":"https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/README.md"},{"source":"cna@vuldb.com","url":"https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.py"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124580"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1038438"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432937"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432937/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:chengdu_feiyuxing_technology:vw2100:*:*:*:*:*:*:*:*"],"modules":["Weixin Auth Endpoint"],"product":"VW2100","vendor":"Chengdu Feiyuxing Technology","versions":[{"status":"affected","version":"1.0 B-MB3W202-210825-r11775"}]},{"cpes":["cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp:*:*:*:*:*:*:*:*"],"modules":["Weixin Auth Endpoint"],"product":"VEC10GP","vendor":"Chengdu Feiyuxing Technology","versions":[{"status":"affected","version":"1.0 B-MB3W202-210825-r11775"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-124580","lastModified":"2026-11-12T20:18:29.310","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":10.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":10.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124580","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:45:37.304334Z","version":"2.0.3"}}]},"published":"2026-11-09T08:17:02.923","references":[{"source":"cna@vuldb.com","url":"https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/README.md"},{"source":"cna@vuldb.com","url":"https://github.com/Walnut1337/Feiyuxing_VROS_command_injection/blob/main/poc_weixin_auth.py"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124580"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1038438"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432937"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/432937/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124585.json b/data/2026/CVE-2026-124585.json index 5b6d943e31..380a018f4d 100644 --- a/data/2026/CVE-2026-124585.json +++ b/data/2026/CVE-2026-124585.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:chengdu_feiyuxing_technology:vw2100:*:*:*:*:*:*:*:*"],"modules":["Web Administration Interface"],"product":"VW2100","vendor":"Chengdu Feiyuxing Technology","versions":[{"status":"affected","version":"1.0 B-MB3W202-210825-r11775"}]},{"cpes":["cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp:*:*:*:*:*:*:*:*"],"modules":["Web Administration Interface"],"product":"VEC10GP","vendor":"Chengdu Feiyuxing Technology","versions":[{"status":"affected","version":"1.0 B-MB3W202-210825-r11775"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-124585","lastModified":"2026-11-09T09:16:59.680","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"COMPLETE","baseScore":9.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":8.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-09T09:16:59.517","references":[{"source":"cna@vuldb.com","url":"https://github.com/C0KE/Feiyuxing-VROS-add_expmac-RCE/blob/main/poc_add_expmac.py"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124585"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1039019"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433009"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433009/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:chengdu_feiyuxing_technology:vw2100:*:*:*:*:*:*:*:*"],"modules":["Web Administration Interface"],"product":"VW2100","vendor":"Chengdu Feiyuxing Technology","versions":[{"status":"affected","version":"1.0 B-MB3W202-210825-r11775"}]},{"cpes":["cpe:2.3:a:chengdu_feiyuxing_technology:vec10gp:*:*:*:*:*:*:*:*"],"modules":["Web Administration Interface"],"product":"VEC10GP","vendor":"Chengdu Feiyuxing Technology","versions":[{"status":"affected","version":"1.0 B-MB3W202-210825-r11775"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-124585","lastModified":"2026-11-12T20:18:29.547","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"COMPLETE","baseScore":9.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":8.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124585","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:46:17.745028Z","version":"2.0.3"}}]},"published":"2026-11-09T09:16:59.517","references":[{"source":"cna@vuldb.com","url":"https://github.com/C0KE/Feiyuxing-VROS-add_expmac-RCE/blob/main/poc_add_expmac.py"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124585"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1039019"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433009"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433009/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124589.json b/data/2026/CVE-2026-124589.json index 1455cd7734..9365ee7f19 100644 --- a/data/2026/CVE-2026-124589.json +++ b/data/2026/CVE-2026-124589.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:lxtgh:omg-seg:*:*:*:*:*:*:*:*"],"modules":["MoE Shard Checkpoint Loader"],"product":"OMG-Seg","vendor":"lxtGH","versions":[{"status":"affected","version":"f3b26b609bae919760cd3ccf09c36179bb8624a0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}],"id":"CVE-2026-124589","lastModified":"2026-11-09T10:17:09.773","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-09T10:17:09.540","references":[{"source":"cna@vuldb.com","url":"https://github.com/lxtGH/OMG-Seg/"},{"source":"cna@vuldb.com","url":"https://github.com/lxtGH/OMG-Seg/issues/78"},{"source":"cna@vuldb.com","url":"https://github.com/user-attachments/files/33587423/poc.zip"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124589"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040376"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433013"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433013/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:lxtgh:omg-seg:*:*:*:*:*:*:*:*"],"modules":["MoE Shard Checkpoint Loader"],"product":"OMG-Seg","vendor":"lxtGH","versions":[{"status":"affected","version":"f3b26b609bae919760cd3ccf09c36179bb8624a0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}],"id":"CVE-2026-124589","lastModified":"2026-11-12T20:18:29.773","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124589","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:54:26.621280Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:09.540","references":[{"source":"cna@vuldb.com","url":"https://github.com/lxtGH/OMG-Seg/"},{"source":"cna@vuldb.com","url":"https://github.com/lxtGH/OMG-Seg/issues/78"},{"source":"cna@vuldb.com","url":"https://github.com/user-attachments/files/33587423/poc.zip"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124589"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040376"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433013"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433013/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124598.json b/data/2026/CVE-2026-124598.json index 34b26484c0..3348665eb9 100644 --- a/data/2026/CVE-2026-124598.json +++ b/data/2026/CVE-2026-124598.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.face","product":"GV-Face","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"2.2.1"},{"status":"unaffected","version":"2.2.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An\nAPI key is hardcoded and retrievable from the GV-Face package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key."}],"id":"CVE-2026-124598","lastModified":"2026-11-10T01:17:18.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]},"published":"2026-11-10T01:17:18.193","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://www.geovision.com.tw/cyber_security.php"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.face","product":"GV-Face","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"2.2.1"},{"status":"unaffected","version":"2.2.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An\nAPI key is hardcoded and retrievable from the GV-Face package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key."}],"id":"CVE-2026-124598","lastModified":"2026-11-12T17:17:30.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124598","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:08:18.909919Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:18.193","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://www.geovision.com.tw/cyber_security.php"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124599.json b/data/2026/CVE-2026-124599.json index bae51fbfa2..4a559b91ad 100644 --- a/data/2026/CVE-2026-124599.json +++ b/data/2026/CVE-2026-124599.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.face","platforms":["Android"],"product":"GV-Face","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"2.2.1"},{"status":"unaffected","version":"2.2.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RSA cryptographic key material, including a private key and public key, is\nembedded within the application package. Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations."}],"id":"CVE-2026-124599","lastModified":"2026-11-10T01:17:18.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]},"published":"2026-11-10T01:17:18.333","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.face","platforms":["Android"],"product":"GV-Face","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"2.2.1"},{"status":"unaffected","version":"2.2.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RSA cryptographic key material, including a private key and public key, is\nembedded within the application package. Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations."}],"id":"CVE-2026-124599","lastModified":"2026-11-12T18:17:21.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:25:29.230280Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:18.333","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124600.json b/data/2026/CVE-2026-124600.json index 313351d008..f54cf777cb 100644 --- a/data/2026/CVE-2026-124600.json +++ b/data/2026/CVE-2026-124600.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":": tw.com.geovision.face","platforms":["Android"],"product":"GV-Face","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"2.2.1"},{"status":"unaffected","version":"2.2.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GV-Face transmits sensitive user credentials and\nrelated authentication data over unencrypted HTTP connections. The HTTP\ntraffic is not encrypted, an attacker with the ability to intercept network\ntraffic."}],"id":"CVE-2026-124600","lastModified":"2026-11-10T01:17:18.467","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]},"published":"2026-11-10T01:17:18.467","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-319"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":": tw.com.geovision.face","platforms":["Android"],"product":"GV-Face","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"2.2.1"},{"status":"unaffected","version":"2.2.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GV-Face transmits sensitive user credentials and\nrelated authentication data over unencrypted HTTP connections. The HTTP\ntraffic is not encrypted, an attacker with the ability to intercept network\ntraffic."}],"id":"CVE-2026-124600","lastModified":"2026-11-12T18:17:21.727","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124600","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:26:28.455907Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:18.467","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-319"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124601.json b/data/2026/CVE-2026-124601.json index dae63f7686..3eb8bc68cf 100644 --- a/data/2026/CVE-2026-124601.json +++ b/data/2026/CVE-2026-124601.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.gvaccesscontrol","platforms":["Android"],"product":"GV-Access","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.6.1"},{"status":"unaffected","version":"1.6.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An\nAPI key is hardcoded and retrievable from the GV-Access package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key."}],"id":"CVE-2026-124601","lastModified":"2026-11-10T01:17:18.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]},"published":"2026-11-10T01:17:18.623","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://www.geovision.com.tw/cyber_security.php"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.gvaccesscontrol","platforms":["Android"],"product":"GV-Access","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.6.1"},{"status":"unaffected","version":"1.6.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An\nAPI key is hardcoded and retrievable from the GV-Access package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key."}],"id":"CVE-2026-124601","lastModified":"2026-11-12T18:17:21.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124601","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:28:08.782806Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:18.623","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://www.geovision.com.tw/cyber_security.php"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124602.json b/data/2026/CVE-2026-124602.json index 83950df43b..260cd117c2 100644 --- a/data/2026/CVE-2026-124602.json +++ b/data/2026/CVE-2026-124602.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.gvaccesscontrol","platforms":["Android"],"product":"GV-Access","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.6.1"},{"status":"unaffected","version":"1.6.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RSA cryptographic\nkey material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations."}],"id":"CVE-2026-124602","lastModified":"2026-11-10T01:17:18.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]},"published":"2026-11-10T01:17:18.770","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://www.geovision.com.tw/cyber_security.php"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.gvaccesscontrol","platforms":["Android"],"product":"GV-Access","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.6.1"},{"status":"unaffected","version":"1.6.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RSA cryptographic\nkey material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations."}],"id":"CVE-2026-124602","lastModified":"2026-11-12T18:17:22.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124602","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:28:32.608791Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:18.770","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://www.geovision.com.tw/cyber_security.php"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124603.json b/data/2026/CVE-2026-124603.json index d36a72192c..efb1f1f8e8 100644 --- a/data/2026/CVE-2026-124603.json +++ b/data/2026/CVE-2026-124603.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.nativityGvloud","platforms":["Android"],"product":"GV-Cloud","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.5.1"},{"status":"unaffected","version":"1.5.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An API key is\nhardcoded and retrievable from the GV-Cloud application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key."}],"id":"CVE-2026-124603","lastModified":"2026-11-10T01:17:18.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]},"published":"2026-11-10T01:17:18.900","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://www.geovision.com.tw/cyber_security.php"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.nativityGvloud","platforms":["Android"],"product":"GV-Cloud","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.5.1"},{"status":"unaffected","version":"1.5.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An API key is\nhardcoded and retrievable from the GV-Cloud application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key."}],"id":"CVE-2026-124603","lastModified":"2026-11-12T18:17:22.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124603","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:37.049850Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:18.900","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://www.geovision.com.tw/cyber_security.php"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124604.json b/data/2026/CVE-2026-124604.json index 7f60864a50..28610abd78 100644 --- a/data/2026/CVE-2026-124604.json +++ b/data/2026/CVE-2026-124604.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.nativityGvloud","platforms":["Android"],"product":"GV-Cloud","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.5.1"},{"status":"unaffected","version":"1.5.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RSA cryptographic key\nmaterial, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations."}],"id":"CVE-2026-124604","lastModified":"2026-11-10T01:17:19.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]},"published":"2026-11-10T01:17:19.043","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://www.geovision.com.tw/cyber_security.php"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.nativityGvloud","platforms":["Android"],"product":"GV-Cloud","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.5.1"},{"status":"unaffected","version":"1.5.2"}]}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RSA cryptographic key\nmaterial, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations."}],"id":"CVE-2026-124604","lastModified":"2026-11-12T18:17:22.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:13.455417Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:19.043","references":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","url":"https://www.geovision.com.tw/cyber_security.php"}],"sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124627.json b/data/2026/CVE-2026-124627.json index a793b74e3a..164dcc581d 100644 --- a/data/2026/CVE-2026-124627.json +++ b/data/2026/CVE-2026-124627.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13526","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"2026.3.15926","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams."}],"id":"CVE-2026-124627","lastModified":"2026-11-12T14:17:28.443","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-12T14:17:28.443","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-23"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@octopus.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13526","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"2026.3.15926","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that user receiving the LDAP-mapped team memberships and associated permissions of another user. This issue only affects instances with LDAP authentication enabled and LDAP groups mapped to Octopus teams."}],"id":"CVE-2026-124627","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-12T14:17:28.443","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-23"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@octopus.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124628.json b/data/2026/CVE-2026-124628.json index 0ac605be55..60f3f460e1 100644 --- a/data/2026/CVE-2026-124628.json +++ b/data/2026/CVE-2026-124628.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13526","status":"affected","version":"2018.3.0","versionType":"custom"},{"lessThan":"2026.3.15936","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged."}],"id":"CVE-2026-124628","lastModified":"2026-11-12T14:17:28.587","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-12T14:17:28.587","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-24"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@octopus.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13526","status":"affected","version":"2018.3.0","versionType":"custom"},{"lessThan":"2026.3.15936","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that identity even when an Administrator had disabled self-service identity editing. This could result in the user gaining membership of teams mapped to external LDAP groups they do not belong to, and potentially escalating to full administrative privileges if any of those teams are privileged."}],"id":"CVE-2026-124628","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-12T14:17:28.587","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-24"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@octopus.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124637.json b/data/2026/CVE-2026-124637.json index ff82458934..2d00923cdd 100644 --- a/data/2026/CVE-2026-124637.json +++ b/data/2026/CVE-2026-124637.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Tankuam Places","vendor":"Kompini","versions":[{"status":"affected","version":"versions prior to app.00007.00005 (December 2025)"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser."}],"id":"CVE-2026-124637","lastModified":"2026-11-12T15:17:48.753","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124637","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:56:04.799872Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:09.827","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-tankuam-places"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Tankuam Places","vendor":"Kompini","versions":[{"status":"affected","version":"versions prior to app.00007.00005 (December 2025)"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser."}],"id":"CVE-2026-124637","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124637","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:56:04.799872Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:09.827","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-tankuam-places"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124647.json b/data/2026/CVE-2026-124647.json index ddbe70a4de..c3286733d0 100644 --- a/data/2026/CVE-2026-124647.json +++ b/data/2026/CVE-2026-124647.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TI WooCommerce Wishlist","vendor":"Unknown","versions":[{"lessThan":"2.0.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a SQL statement in a front-end endpoint, allowing unauthenticated users to perform SQL injection attacks."}],"id":"CVE-2026-124647","lastModified":"2026-11-12T12:18:21.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124647","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:42.462628Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.150","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/d0119edb-2845-4106-a2bf-0ef28949ae32/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TI WooCommerce Wishlist","vendor":"Unknown","versions":[{"lessThan":"2.0.7","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a SQL statement in a front-end endpoint, allowing unauthenticated users to perform SQL injection attacks."}],"id":"CVE-2026-124647","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124647","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:42.462628Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.150","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/d0119edb-2845-4106-a2bf-0ef28949ae32/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124648.json b/data/2026/CVE-2026-124648.json index 9467c60b46..a51355cc73 100644 --- a/data/2026/CVE-2026-124648.json +++ b/data/2026/CVE-2026-124648.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TI WooCommerce Wishlist","vendor":"Unknown","versions":[{"lessThan":"2.13.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists."}],"id":"CVE-2026-124648","lastModified":"2026-11-12T12:18:21.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124648","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:31.449875Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.270","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/528218ee-f437-4028-aae0-022435cbb66e/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TI WooCommerce Wishlist","vendor":"Unknown","versions":[{"lessThan":"2.13.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wishlist before letting them manage it, allowing unauthenticated users who know or guess a wishlist's share key to delete items from other customers' wishlists."}],"id":"CVE-2026-124648","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124648","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:31.449875Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.270","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/528218ee-f437-4028-aae0-022435cbb66e/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124652.json b/data/2026/CVE-2026-124652.json index fa29a67d32..8afcf3c002 100644 --- a/data/2026/CVE-2026-124652.json +++ b/data/2026/CVE-2026-124652.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mine CloudVod","vendor":"Unknown","versions":[{"lessThan":"2.6.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment status, allowing any authenticated user, such as subscriber, to read other customers' order status, the purchased item and, while an Alipay payment is in progress, the buyer's Alipay account identifier."}],"id":"CVE-2026-124652","lastModified":"2026-11-12T12:18:21.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124652","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:20.704845Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.400","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/ed4ce4b8-a30b-443c-9b5a-b7415e30eb62/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mine CloudVod","vendor":"Unknown","versions":[{"lessThan":"2.6.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment status, allowing any authenticated user, such as subscriber, to read other customers' order status, the purchased item and, while an Alipay payment is in progress, the buyer's Alipay account identifier."}],"id":"CVE-2026-124652","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124652","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:20.704845Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.400","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/ed4ce4b8-a30b-443c-9b5a-b7415e30eb62/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124653.json b/data/2026/CVE-2026-124653.json index 9dcb119470..2cf4236657 100644 --- a/data/2026/CVE-2026-124653.json +++ b/data/2026/CVE-2026-124653.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mine CloudVod","vendor":"Unknown","versions":[{"lessThan":"2.6.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage."}],"id":"CVE-2026-124653","lastModified":"2026-11-12T12:18:21.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124653","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:13.321729Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.513","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/c476458c-215d-4056-bd82-06e59f0f84d4/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mine CloudVod","vendor":"Unknown","versions":[{"lessThan":"2.6.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage."}],"id":"CVE-2026-124653","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124653","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:13.321729Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.513","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/c476458c-215d-4056-bd82-06e59f0f84d4/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124665.json b/data/2026/CVE-2026-124665.json index 5f34a0e452..977114c078 100644 --- a/data/2026/CVE-2026-124665.json +++ b/data/2026/CVE-2026-124665.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Order Tracking","vendor":"Unknown","versions":[{"lessThan":"3.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions."}],"id":"CVE-2026-124665","lastModified":"2026-11-12T12:18:22.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124665","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:05.348591Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.627","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/9165da1e-76b7-4364-9fd7-67ccb96afc48/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Order Tracking","vendor":"Unknown","versions":[{"lessThan":"3.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions."}],"id":"CVE-2026-124665","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124665","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:17:05.348591Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.627","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/9165da1e-76b7-4364-9fd7-67ccb96afc48/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124683.json b/data/2026/CVE-2026-124683.json index a15fbba17a..21d9e75c02 100644 --- a/data/2026/CVE-2026-124683.json +++ b/data/2026/CVE-2026-124683.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Langium","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"3.2.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected."}],"id":"CVE-2026-124683","lastModified":"2026-11-09T17:17:27.690","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124683","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:47:35.260234Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:27.690","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-langium/langium/security/advisories/GHSA-297v-g8mm-qj4h"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/553"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1069"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Langium","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"3.2.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected."}],"id":"CVE-2026-124683","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124683","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:47:35.260234Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:27.690","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-langium/langium/security/advisories/GHSA-297v-g8mm-qj4h"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/553"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1069"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124691.json b/data/2026/CVE-2026-124691.json new file mode 100644 index 0000000000..20ca96f02b --- /dev/null +++ b/data/2026/CVE-2026-124691.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Kendo UI for jQuery","vendor":"Progress Software","versions":[{"lessThanOrEqual":"2026.3.1015","status":"affected","version":"2020.3.915","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111."}],"id":"CVE-2026-124691","lastModified":"2026-11-12T17:17:30.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T17:17:30.637","references":[{"source":"security@progress.com","url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-gantt-parent-dropdown-xss-cve-2026-124691"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124695.json b/data/2026/CVE-2026-124695.json new file mode 100644 index 0000000000..9c1788984e --- /dev/null +++ b/data/2026/CVE-2026-124695.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kendo UI for jQuery","vendor":"Progress Software","versions":[{"lessThanOrEqual":"2026.3.1015","status":"affected","version":"2020.2.513","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111."}],"id":"CVE-2026-124695","lastModified":"2026-11-12T17:17:30.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T17:17:30.790","references":[{"source":"security@progress.com","url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-form-item-hint-xss-cve-2026-124695"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124696.json b/data/2026/CVE-2026-124696.json new file mode 100644 index 0000000000..cca7687b33 --- /dev/null +++ b/data/2026/CVE-2026-124696.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kendo UI for jQuery","vendor":"Progress Software","versions":[{"lessThanOrEqual":"2026.3.1015","status":"affected","version":"2024.4.1112","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111."}],"id":"CVE-2026-124696","lastModified":"2026-11-12T17:17:31.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T17:17:30.993","references":[{"source":"security@progress.com","url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-spreadsheet-sheet-names-xss-cve-2026-124696"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124697.json b/data/2026/CVE-2026-124697.json new file mode 100644 index 0000000000..8f676172d9 --- /dev/null +++ b/data/2026/CVE-2026-124697.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kendo UI for jQuery","vendor":"Progress Software","versions":[{"lessThanOrEqual":"2026.3.1015","status":"affected","version":"2016.2.607","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111."}],"id":"CVE-2026-124697","lastModified":"2026-11-12T17:17:31.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T17:17:31.160","references":[{"source":"security@progress.com","url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-chart-shared-tooltip-xss-cve-2026-124697"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124698.json b/data/2026/CVE-2026-124698.json new file mode 100644 index 0000000000..930887b2f8 --- /dev/null +++ b/data/2026/CVE-2026-124698.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kendo UI for jQuery","vendor":"Progress Software","versions":[{"lessThanOrEqual":"2026.3.1015","status":"affected","version":"2016.2.607","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111."}],"id":"CVE-2026-124698","lastModified":"2026-11-12T17:17:31.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T17:17:31.320","references":[{"source":"security@progress.com","url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-chart-tooltip-point-value-xss-cve-2026-124698"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124699.json b/data/2026/CVE-2026-124699.json index bde5a558db..cdb872eee1 100644 --- a/data/2026/CVE-2026-124699.json +++ b/data/2026/CVE-2026-124699.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application."}],"id":"CVE-2026-124699","lastModified":"2026-11-12T10:17:28.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T10:17:28.723","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124699"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application."}],"id":"CVE-2026-124699","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T10:17:28.723","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124699"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124700.json b/data/2026/CVE-2026-124700.json new file mode 100644 index 0000000000..e6d43b58a7 --- /dev/null +++ b/data/2026/CVE-2026-124700.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens."}],"id":"CVE-2026-124700","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T18:17:22.537","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124700"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124701.json b/data/2026/CVE-2026-124701.json index cdd7341342..5351cd5544 100644 --- a/data/2026/CVE-2026-124701.json +++ b/data/2026/CVE-2026-124701.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application."}],"id":"CVE-2026-124701","lastModified":"2026-11-12T11:17:10.473","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T11:17:10.473","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124701"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WinForms","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application."}],"id":"CVE-2026-124701","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T11:17:10.473","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124701"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124702.json b/data/2026/CVE-2026-124702.json new file mode 100644 index 0000000000..0adc0a1a36 --- /dev/null +++ b/data/2026/CVE-2026-124702.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens."}],"id":"CVE-2026-124702","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T18:17:22.683","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124702"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124703.json b/data/2026/CVE-2026-124703.json index ef9fb3ce2e..516a9f0fe9 100644 --- a/data/2026/CVE-2026-124703.json +++ b/data/2026/CVE-2026-124703.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application."}],"id":"CVE-2026-124703","lastModified":"2026-11-12T11:17:10.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T11:17:10.743","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124703"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application."}],"id":"CVE-2026-124703","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T11:17:10.743","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124703"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124704.json b/data/2026/CVE-2026-124704.json index 590ce4519f..c78214ac36 100644 --- a/data/2026/CVE-2026-124704.json +++ b/data/2026/CVE-2026-124704.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application."}],"id":"CVE-2026-124704","lastModified":"2026-11-12T11:17:10.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T11:17:10.923","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124704"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for WPF","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1110","status":"affected","version":"2026.3.1007","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application."}],"id":"CVE-2026-124704","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T11:17:10.923","references":[{"source":"security@progress.com","url":"https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124704"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124705.json b/data/2026/CVE-2026-124705.json index b90177813d..d0ea702c7b 100644 --- a/data/2026/CVE-2026-124705.json +++ b/data/2026/CVE-2026-124705.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for .NET MAUI","vendor":"Progress Software","versions":[{"lessThan":"16.0.0","status":"affected","version":"5.2.0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens."}],"id":"CVE-2026-124705","lastModified":"2026-11-12T12:18:22.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T12:18:22.260","references":[{"source":"security@progress.com","url":"https://www.telerik.com/maui-ui/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124705"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@progress.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Telerik UI for .NET MAUI","vendor":"Progress Software","versions":[{"lessThan":"16.0.0","status":"affected","version":"5.2.0","versionType":"custom"}]}],"source":"security@progress.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via a crafted document or PDF link with a non-allowlisted URI scheme that the user opens."}],"id":"CVE-2026-124705","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@progress.com","type":"Secondary"}]},"published":"2026-11-12T12:18:22.260","references":[{"source":"security@progress.com","url":"https://www.telerik.com/maui-ui/documentation/knowledge-base/kb-security-untrusted-url-redirection-cve-2026-124705"}],"sourceIdentifier":"security@progress.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@progress.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-124738.json b/data/2026/CVE-2026-124738.json index 29ec9cae5d..616de96141 100644 --- a/data/2026/CVE-2026-124738.json +++ b/data/2026/CVE-2026-124738.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files."}],"id":"CVE-2026-124738","lastModified":"2026-11-11T12:19:47.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T12:19:47.537","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124738"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571610"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files."}],"id":"CVE-2026-124738","lastModified":"2026-11-12T18:17:22.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124738","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:00.406327Z","version":"2.0.3"}}]},"published":"2026-11-11T12:19:47.537","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124738"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571610"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124740.json b/data/2026/CVE-2026-124740.json index 7e7e20ae1b..35dd5c7d6f 100644 --- a/data/2026/CVE-2026-124740.json +++ b/data/2026/CVE-2026-124740.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests."}],"id":"CVE-2026-124740","lastModified":"2026-11-11T12:19:47.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T12:19:47.710","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124740"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571616"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests."}],"id":"CVE-2026-124740","lastModified":"2026-11-12T20:18:30.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124740","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:33:47.214058Z","version":"2.0.3"}}]},"published":"2026-11-11T12:19:47.710","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124740"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571616"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124741.json b/data/2026/CVE-2026-124741.json index b2f363449b..525cf43fcf 100644 --- a/data/2026/CVE-2026-124741.json +++ b/data/2026/CVE-2026-124741.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash."}],"id":"CVE-2026-124741","lastModified":"2026-11-11T11:17:17.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T11:17:17.233","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124741"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571617"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash."}],"id":"CVE-2026-124741","lastModified":"2026-11-12T17:17:31.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124741","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:01:58.788278Z","version":"2.0.3"}}]},"published":"2026-11-11T11:17:17.233","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124741"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571617"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124744.json b/data/2026/CVE-2026-124744.json index 1c7c684c65..d8cac2f9e8 100644 --- a/data/2026/CVE-2026-124744.json +++ b/data/2026/CVE-2026-124744.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations."}],"id":"CVE-2026-124744","lastModified":"2026-11-11T13:17:20.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.2,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T13:17:19.883","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124744"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571625"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations."}],"id":"CVE-2026-124744","lastModified":"2026-11-12T18:17:22.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:31:12.103144Z","version":"2.0.3"}}]},"published":"2026-11-11T13:17:19.883","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124744"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571625"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124745.json b/data/2026/CVE-2026-124745.json index 01b6e3565a..75fd21158e 100644 --- a/data/2026/CVE-2026-124745.json +++ b/data/2026/CVE-2026-124745.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system."}],"id":"CVE-2026-124745","lastModified":"2026-11-11T13:17:20.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.2,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T13:17:20.043","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124745"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571637"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system."}],"id":"CVE-2026-124745","lastModified":"2026-11-12T20:18:30.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124745","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:35:06.918826Z","version":"2.0.3"}}]},"published":"2026-11-11T13:17:20.043","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124745"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571637"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124814.json b/data/2026/CVE-2026-124814.json index a14cb1bbc3..100561c684 100644 --- a/data/2026/CVE-2026-124814.json +++ b/data/2026/CVE-2026-124814.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ultimate Addons for Elementor Forms","vendor":"Unknown","versions":[{"lessThan":"1.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution."}],"id":"CVE-2026-124814","lastModified":"2026-11-12T12:18:22.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124814","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:16:35.357876Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.743","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/85f2e67b-4c6d-4817-9e4d-ef62a7ddb081/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ultimate Addons for Elementor Forms","vendor":"Unknown","versions":[{"lessThan":"1.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution."}],"id":"CVE-2026-124814","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124814","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:16:35.357876Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.743","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/85f2e67b-4c6d-4817-9e4d-ef62a7ddb081/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124815.json b/data/2026/CVE-2026-124815.json index fcd060182a..ef097dd7b5 100644 --- a/data/2026/CVE-2026-124815.json +++ b/data/2026/CVE-2026-124815.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Clockinator Lite","vendor":"Unknown","versions":[{"lessThan":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes."}],"id":"CVE-2026-124815","lastModified":"2026-11-12T12:18:22.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124815","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:16:19.302230Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.853","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/a7fe2ca1-ddfe-45fa-93e2-e0959ae29256/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Clockinator Lite","vendor":"Unknown","versions":[{"lessThan":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes."}],"id":"CVE-2026-124815","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124815","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:16:19.302230Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.853","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/a7fe2ca1-ddfe-45fa-93e2-e0959ae29256/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124817.json b/data/2026/CVE-2026-124817.json index 22ed3c0311..a1ca6b80f5 100644 --- a/data/2026/CVE-2026-124817.json +++ b/data/2026/CVE-2026-124817.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Clockinator Lite","vendor":"Unknown","versions":[{"lessThan":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users."}],"id":"CVE-2026-124817","lastModified":"2026-11-12T12:18:22.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124817","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:16:04.157942Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.963","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/31b79fe5-89ee-4ccf-b3c4-48ab46fa499c/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Clockinator Lite","vendor":"Unknown","versions":[{"lessThan":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users."}],"id":"CVE-2026-124817","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124817","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:16:04.157942Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:13.963","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/31b79fe5-89ee-4ccf-b3c4-48ab46fa499c/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124848.json b/data/2026/CVE-2026-124848.json index 813c204af0..fd7d69f092 100644 --- a/data/2026/CVE-2026-124848.json +++ b/data/2026/CVE-2026-124848.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kiro CLI","vendor":"Amazon","versions":[{"lessThan":"2.27.0","status":"affected","version":"1.16.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain. The CLI created its local session storage files with permissions that made them readable by all local users.\n\n\n\nTo remediate this issue, users should upgrade to Kiro CLI version 2.27.0 or later and launch it once. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also delete the ~/.aws/amazonq/.cli_bash_history file or restrict it to the owner."}],"id":"CVE-2026-124848","lastModified":"2026-11-10T20:19:07.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-10T20:19:07.390","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-178-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://kiro.dev/changelog/cli/2-27/"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kiro CLI","vendor":"Amazon","versions":[{"lessThan":"2.27.0","status":"affected","version":"1.16.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain. The CLI created its local session storage files with permissions that made them readable by all local users.\n\n\n\nTo remediate this issue, users should upgrade to Kiro CLI version 2.27.0 or later and launch it once. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also delete the ~/.aws/amazonq/.cli_bash_history file or restrict it to the owner."}],"id":"CVE-2026-124848","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-10T20:19:07.390","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-178-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://kiro.dev/changelog/cli/2-27/"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124850.json b/data/2026/CVE-2026-124850.json index bad01ddc3e..a775bc5fe7 100644 --- a/data/2026/CVE-2026-124850.json +++ b/data/2026/CVE-2026-124850.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:*"],"modules":["migrations"],"product":"flowintel","programFiles":["migrations/versions/5cd03995339b_.py"],"repo":"https://github.com/flowintel/flowintel","vendor":"flowintel","versions":[{"lessThanOrEqual":"4.0.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A SQL injection vulnerability exists in a database migration script in flowintel.\n\nThe migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.\n\n- Requires prior write access to the database to plant a malicious identifier value\n- Triggered automatically during a migration or upgrade operation\n- Can result in unauthorized data disclosure, modification, or deletion\n\nAffected versions: flowintel prior to 4.0.0"}],"id":"CVE-2026-124850","lastModified":"2026-11-09T15:17:19.020","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"Supplier","timestamp":"2026-11-09T14:12:17Z","version":"2.0.3"}}]},"published":"2026-11-09T15:17:19.020","references":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d"}],"sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:flowintel:flowintel:*:*:*:*:*:*:*:*"],"modules":["migrations"],"product":"flowintel","programFiles":["migrations/versions/5cd03995339b_.py"],"repo":"https://github.com/flowintel/flowintel","vendor":"flowintel","versions":[{"lessThanOrEqual":"4.0.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A SQL injection vulnerability exists in a database migration script in flowintel.\n\nThe migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.\n\n- Requires prior write access to the database to plant a malicious identifier value\n- Triggered automatically during a migration or upgrade operation\n- Can result in unauthorized data disclosure, modification, or deletion\n\nAffected versions: flowintel prior to 4.0.0"}],"id":"CVE-2026-124850","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"Supplier","timestamp":"2026-11-09T14:12:17Z","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:24:26.530803Z","version":"2.0.3"}}]},"published":"2026-11-09T15:17:19.020","references":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d"}],"sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124853.json b/data/2026/CVE-2026-124853.json index dc2131b23f..e4b48eebbe 100644 --- a/data/2026/CVE-2026-124853.json +++ b/data/2026/CVE-2026-124853.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"115.*","status":"unaffected","version":"115.45","versionType":"rpm"},{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}],"id":"CVE-2026-124853","lastModified":"2026-11-10T21:19:08.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124853","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:40:48.444928Z","version":"2.0.3"}}]},"published":"2026-11-10T14:17:17.007","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2058035"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-125/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-126/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-128/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"115.*","status":"unaffected","version":"115.45","versionType":"rpm"},{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}],"id":"CVE-2026-124853","lastModified":"2026-11-12T20:18:30.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124853","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:40:48.444928Z","version":"2.0.3"}}]},"published":"2026-11-10T14:17:17.007","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2058035"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-125/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-126/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-128/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124861.json b/data/2026/CVE-2026-124861.json index 7ea65268bc..f329b0da20 100644 --- a/data/2026/CVE-2026-124861.json +++ b/data/2026/CVE-2026-124861.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"115.*","status":"unaffected","version":"115.45","versionType":"rpm"},{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}],"id":"CVE-2026-124861","lastModified":"2026-11-10T21:19:10.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124861","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:31:49.215850Z","version":"2.0.3"}}]},"published":"2026-11-10T14:17:18.447","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2074210"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-125/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-126/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-128/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"115.*","status":"unaffected","version":"115.45","versionType":"rpm"},{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}],"id":"CVE-2026-124861","lastModified":"2026-11-12T20:18:30.677","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124861","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:31:49.215850Z","version":"2.0.3"}}]},"published":"2026-11-10T14:17:18.447","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2074210"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-125/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-126/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-128/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124916.json b/data/2026/CVE-2026-124916.json index 6dcc295aea..39aa78d63d 100644 --- a/data/2026/CVE-2026-124916.json +++ b/data/2026/CVE-2026-124916.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"PrestaShop","vendor":"PrestaShop","versions":[{"lessThan":"9.2.1","status":"affected","version":"1.5.0.0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process."}],"id":"CVE-2026-124916","lastModified":"2026-11-09T17:17:27.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124916","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:33:44.023769Z","version":"2.0.3"}}]},"published":"2026-11-09T15:17:19.227","references":[{"source":"cret@cert.org","url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q"},{"source":"cret@cert.org","url":"https://prestashop.com/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.kb.cert.org/vuls/id/385711"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"PrestaShop","vendor":"PrestaShop","versions":[{"lessThan":"9.2.1","status":"affected","version":"1.5.0.0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process."}],"id":"CVE-2026-124916","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124916","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:33:44.023769Z","version":"2.0.3"}}]},"published":"2026-11-09T15:17:19.227","references":[{"source":"cret@cert.org","url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q"},{"source":"cret@cert.org","url":"https://prestashop.com/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.kb.cert.org/vuls/id/385711"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124917.json b/data/2026/CVE-2026-124917.json index e69a87a37d..519ddfd6b0 100644 --- a/data/2026/CVE-2026-124917.json +++ b/data/2026/CVE-2026-124917.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}],"id":"CVE-2026-124917","lastModified":"2026-11-10T21:19:18.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124917","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:32:40.519577Z","version":"2.0.3"}}]},"published":"2026-11-10T14:17:25.483","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2058648"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-125/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-128/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}],"id":"CVE-2026-124917","lastModified":"2026-11-12T20:18:30.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124917","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:32:40.519577Z","version":"2.0.3"}}]},"published":"2026-11-10T14:17:25.483","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2058648"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-125/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-128/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124959.json b/data/2026/CVE-2026-124959.json index 405901a1ab..a72df0ecdd 100644 --- a/data/2026/CVE-2026-124959.json +++ b/data/2026/CVE-2026-124959.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Voyager","vendor":"Spotify","versions":[{"lessThanOrEqual":"2.1.1","status":"affected","version":"2.0.7","versionType":"custom"}]},{"product":"hnswlib","vendor":"hnswlib","versions":[{"lessThanOrEqual":"0.9.0","status":"affected","version":"0.5.0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file."}],"id":"CVE-2026-124959","lastModified":"2026-11-09T15:17:19.357","metrics":{},"published":"2026-11-09T15:17:19.357","references":[{"source":"cret@cert.org","url":"https://github.com/nmslib/hnswlib"},{"source":"cret@cert.org","url":"https://github.com/spotify/voyager"},{"source":"cret@cert.org","url":"https://m00dy.sh/notes/when-an-hnsw-index-lies-about-its-capacity"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"Voyager","vendor":"Spotify","versions":[{"lessThanOrEqual":"2.1.1","status":"affected","version":"2.0.7","versionType":"custom"}]},{"product":"hnswlib","vendor":"hnswlib","versions":[{"lessThanOrEqual":"0.9.0","status":"affected","version":"0.5.0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file."}],"id":"CVE-2026-124959","lastModified":"2026-11-12T19:22:01.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124959","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:40:51.440851Z","version":"2.0.3"}}]},"published":"2026-11-09T15:17:19.357","references":[{"source":"cret@cert.org","url":"https://github.com/nmslib/hnswlib"},{"source":"cret@cert.org","url":"https://github.com/spotify/voyager"},{"source":"cret@cert.org","url":"https://m00dy.sh/notes/when-an-hnsw-index-lies-about-its-capacity"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124993.json b/data/2026/CVE-2026-124993.json index c4f182ee91..d1e61377fe 100644 --- a/data/2026/CVE-2026-124993.json +++ b/data/2026/CVE-2026-124993.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files."}],"id":"CVE-2026-124993","lastModified":"2026-11-12T04:17:17.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:17.937","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files."}],"id":"CVE-2026-124993","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:17.937","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125064.json b/data/2026/CVE-2026-125064.json index 0ce6396a20..262fb0faa8 100644 --- a/data/2026/CVE-2026-125064.json +++ b/data/2026/CVE-2026-125064.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer, crashing the process."}],"id":"CVE-2026-125064","lastModified":"2026-11-10T21:46:30.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125064","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:07:09.702559Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:48.643","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g726.c#L473"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/ec887b13a88afbaf44fb28c3045bda5d434da8dc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-g-726-adpcm-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer, crashing the process."}],"id":"CVE-2026-125064","lastModified":"2026-11-10T21:46:30.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125064","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:07:09.702559Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:48.643","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g726.c#L473"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/ec887b13a88afbaf44fb28c3045bda5d434da8dc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-g-726-adpcm-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125065.json b/data/2026/CVE-2026-125065.json index a4b9b39f34..179c874b33 100644 --- a/data/2026/CVE-2026-125065.json +++ b/data/2026/CVE-2026-125065.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section, crashing the process for denial of service."}],"id":"CVE-2026-125065","lastModified":"2026-11-10T21:46:30.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125065","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:06:51.290620Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:48.807","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/eatgv.c#L212"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/9691e4fde64e14de73c298562c4e475f9412b5ad"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-via-tgv-decoder-eatgv-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section, crashing the process for denial of service."}],"id":"CVE-2026-125065","lastModified":"2026-11-10T21:46:30.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125065","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:06:51.290620Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:48.807","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/eatgv.c#L212"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/9691e4fde64e14de73c298562c4e475f9412b5ad"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-via-tgv-decoder-eatgv-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125066.json b/data/2026/CVE-2026-125066.json index 4c1dbc3afa..fb79aa6570 100644 --- a/data/2026/CVE-2026-125066.json +++ b/data/2026/CVE-2026-125066.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process."}],"id":"CVE-2026-125066","lastModified":"2026-11-10T21:46:26.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125066","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:06:33.478635Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:48.960","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cljrdec.c#L54"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/d40c1b12811814fc6c2d0816527b003d8510ea06"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-cljr-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process."}],"id":"CVE-2026-125066","lastModified":"2026-11-10T21:46:26.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125066","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:06:33.478635Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:48.960","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cljrdec.c#L54"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/d40c1b12811814fc6c2d0816527b003d8510ea06"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-cljr-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125067.json b/data/2026/CVE-2026-125067.json index d57c544fa6..cf3d53d48b 100644 --- a/data/2026/CVE-2026-125067.json +++ b/data/2026/CVE-2026-125067.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that crash the process."}],"id":"CVE-2026-125067","lastModified":"2026-11-10T21:46:26.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125067","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:06:16.786590Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.103","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vble.c#L139"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/1206df65e54b6e9c01459c7cd9a95f9bde2736d7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vble-decoder-null-pointer-dereference-via-vble-decode-frame"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that crash the process."}],"id":"CVE-2026-125067","lastModified":"2026-11-10T21:46:26.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125067","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:06:16.786590Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.103","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vble.c#L139"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/1206df65e54b6e9c01459c7cd9a95f9bde2736d7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vble-decoder-null-pointer-dereference-via-vble-decode-frame"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125068.json b/data/2026/CVE-2026-125068.json index c211bef08d..7196395c30 100644 --- a/data/2026/CVE-2026-125068.json +++ b/data/2026/CVE-2026-125068.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service."}],"id":"CVE-2026-125068","lastModified":"2026-11-10T21:46:26.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125068","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:05:59.770500Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.257","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/bink.c#L1275"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/5195d6f9729ad00b93e4d0f0bea309416fb4713e"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-bink-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for denial of service."}],"id":"CVE-2026-125068","lastModified":"2026-11-10T21:46:26.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125068","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:05:59.770500Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.257","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/bink.c#L1275"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/5195d6f9729ad00b93e4d0f0bea309416fb4713e"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-bink-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125069.json b/data/2026/CVE-2026-125069.json index 3cf0ffd7a2..53acd4c5c0 100644 --- a/data/2026/CVE-2026-125069.json +++ b/data/2026/CVE-2026-125069.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp_decode_frame() ignores init_get_bits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the process."}],"id":"CVE-2026-125069","lastModified":"2026-11-10T21:46:26.413","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125069","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:05:43.202815Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.407","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/motionpixels.c#L302"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/26b4c37526fe0ecf1095b45daac08050f25f7659"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-via-motion-pixels-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp_decode_frame() ignores init_get_bits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the process."}],"id":"CVE-2026-125069","lastModified":"2026-11-10T21:46:26.413","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125069","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:05:43.202815Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.407","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/motionpixels.c#L302"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/26b4c37526fe0ecf1095b45daac08050f25f7659"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-via-motion-pixels-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12507.json b/data/2026/CVE-2026-12507.json index d4e2b4f0e6..33b8a53b1a 100644 --- a/data/2026/CVE-2026-12507.json +++ b/data/2026/CVE-2026-12507.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AssetExplorer","vendor":"Zohocorp","versions":[{"lessThan":"7860","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus","vendor":"Zohocorp","versions":[{"lessThan":"15290","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus MSP","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"SupportCenter Plus","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server."}],"id":"CVE-2026-12507","lastModified":"2026-11-12T07:16:46.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T07:16:46.750","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/products/service-desk/cve-2026-12507.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AssetExplorer","vendor":"Zohocorp","versions":[{"lessThan":"7860","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus","vendor":"Zohocorp","versions":[{"lessThan":"15290","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus MSP","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"SupportCenter Plus","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server."}],"id":"CVE-2026-12507","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T07:16:46.750","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/products/service-desk/cve-2026-12507.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125070.json b/data/2026/CVE-2026-125070.json index 6f0d5a1d05..5de4f920b6 100644 --- a/data/2026/CVE-2026-125070.json +++ b/data/2026/CVE-2026-125070.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c, which ignores init_get_bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial of service."}],"id":"CVE-2026-125070","lastModified":"2026-11-10T21:46:41.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125070","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:05:26.870597Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.560","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/eatqi.c#L154"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/5d7b743bdfb724df21fd43a3d7f3258382eb578c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-ea-tqi-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c, which ignores init_get_bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial of service."}],"id":"CVE-2026-125070","lastModified":"2026-11-10T21:46:41.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125070","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:05:26.870597Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.560","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/eatqi.c#L154"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/5d7b743bdfb724df21fd43a3d7f3258382eb578c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-ea-tqi-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125071.json b/data/2026/CVE-2026-125071.json index f25d179294..3ecbab1fed 100644 --- a/data/2026/CVE-2026-125071.json +++ b/data/2026/CVE-2026-125071.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decode_frame() reads from a NULL buffer and causes denial of service."}],"id":"CVE-2026-125071","lastModified":"2026-11-10T21:46:42.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125071","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:05:10.542648Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.730","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/jvdec.c#L169"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/839c93f261cd3e1719edfac4244a2d0055ce8841"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-jv-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decode_frame() reads from a NULL buffer and causes denial of service."}],"id":"CVE-2026-125071","lastModified":"2026-11-10T21:46:42.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125071","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:05:10.542648Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.730","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25704"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/jvdec.c#L169"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/839c93f261cd3e1719edfac4244a2d0055ce8841"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-jv-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125072.json b/data/2026/CVE-2026-125072.json index f49d85c1e0..26483322af 100644 --- a/data/2026/CVE-2026-125072.json +++ b/data/2026/CVE-2026-125072.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process."}],"id":"CVE-2026-125072","lastModified":"2026-11-10T21:46:30.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:04:52.433902Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.990","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25696"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mpegaudiodec_template.c#L1477"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/0b007e0634de5b4424b9993c95a6c1c50de0115b"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-mpeg-audio-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process."}],"id":"CVE-2026-125072","lastModified":"2026-11-10T21:46:30.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:04:52.433902Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:49.990","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25696"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mpegaudiodec_template.c#L1477"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/0b007e0634de5b4424b9993c95a6c1c50de0115b"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-null-pointer-dereference-in-mpeg-audio-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125073.json b/data/2026/CVE-2026-125073.json index 9723c1a8ee..56d1cb8f61 100644 --- a/data/2026/CVE-2026-125073.json +++ b/data/2026/CVE-2026-125073.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU."}],"id":"CVE-2026-125073","lastModified":"2026-11-10T21:46:41.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:04:36.623838Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:50.140","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25696"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/imc.c#L572"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/9b26bb4c9a4457d480899a1bf64ec080eceb1acd"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-denial-of-service-via-imc-iac-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_allocation() in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to never terminate and consuming 100% CPU."}],"id":"CVE-2026-125073","lastModified":"2026-11-10T21:46:41.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:04:36.623838Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:50.140","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25696"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/imc.c#L572"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/9b26bb4c9a4457d480899a1bf64ec080eceb1acd"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-denial-of-service-via-imc-iac-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125074.json b/data/2026/CVE-2026-125074.json index 5f78e3a5e0..1e0579b592 100644 --- a/data/2026/CVE-2026-125074.json +++ b/data/2026/CVE-2026-125074.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"],"modules":["Password Reset"],"product":"Smart Attendance System with QR Code Scanner","vendor":"SourceCodester","versions":[{"status":"affected","version":"1.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used."}],"id":"CVE-2026-125074","lastModified":"2026-11-09T23:17:20.920","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-09T23:17:20.763","references":[{"source":"cna@vuldb.com","url":"https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-01-Unauthenticated-Password-Reset.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-125074"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041011"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433178"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433178/cti"},{"source":"cna@vuldb.com","url":"https://www.sourcecodester.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"],"modules":["Password Reset"],"product":"Smart Attendance System with QR Code Scanner","vendor":"SourceCodester","versions":[{"status":"affected","version":"1.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used."}],"id":"CVE-2026-125074","lastModified":"2026-11-12T19:16:52.867","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125074","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:57:22.317105Z","version":"2.0.3"}}]},"published":"2026-11-09T23:17:20.763","references":[{"source":"cna@vuldb.com","url":"https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-01-Unauthenticated-Password-Reset.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-125074"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041011"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433178"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433178/cti"},{"source":"cna@vuldb.com","url":"https://www.sourcecodester.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125078.json b/data/2026/CVE-2026-125078.json index c9212fcdc7..940fbe97f8 100644 --- a/data/2026/CVE-2026-125078.json +++ b/data/2026/CVE-2026-125078.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"],"product":"Smart Attendance System with QR Code Scanner","vendor":"SourceCodester","versions":[{"status":"affected","version":"1.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks."}],"id":"CVE-2026-125078","lastModified":"2026-11-10T00:17:06.960","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-10T00:17:06.777","references":[{"source":"cna@vuldb.com","url":"https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-06-Session-Fixation.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-125078"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041017"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433183"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433183/cti"},{"source":"cna@vuldb.com","url":"https://www.sourcecodester.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-384"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"],"product":"Smart Attendance System with QR Code Scanner","vendor":"SourceCodester","versions":[{"status":"affected","version":"1.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks."}],"id":"CVE-2026-125078","lastModified":"2026-11-12T19:16:53.027","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125078","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:57:24.615786Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:06.777","references":[{"source":"cna@vuldb.com","url":"https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-06-Session-Fixation.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-125078"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041017"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433183"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433183/cti"},{"source":"cna@vuldb.com","url":"https://www.sourcecodester.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-384"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125087.json b/data/2026/CVE-2026-125087.json index 03e915a04f..f806111cca 100644 --- a/data/2026/CVE-2026-125087.json +++ b/data/2026/CVE-2026-125087.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:michael-a-kuykendall:shimmy:*:*:*:*:*:*:*:*"],"modules":["Inference API"],"product":"Shimmy","vendor":"Michael-A-Kuykendall","versions":[{"status":"affected","version":"2.6.0"},{"status":"affected","version":"2.6.1"},{"status":"affected","version":"2.6.2"},{"status":"affected","version":"2.6.3"},{"status":"affected","version":"2.6.4"},{"status":"unaffected","version":"2.6.5"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component."}],"id":"CVE-2026-125087","lastModified":"2026-11-10T01:17:20.037","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-10T01:17:19.860","references":[{"source":"cna@vuldb.com","url":"https://github.com/Michael-A-Kuykendall/shimmy/"},{"source":"cna@vuldb.com","url":"https://github.com/Michael-A-Kuykendall/shimmy/commit/3f2ee748c02eeb229987913fe289a2ed9a24595d"},{"source":"cna@vuldb.com","url":"https://github.com/Michael-A-Kuykendall/shimmy/issues/221"},{"source":"cna@vuldb.com","url":"https://github.com/Michael-A-Kuykendall/shimmy/releases/tag/v2.6.5"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-125087"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1042415"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433198"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433198/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:michael-a-kuykendall:shimmy:*:*:*:*:*:*:*:*"],"modules":["Inference API"],"product":"Shimmy","vendor":"Michael-A-Kuykendall","versions":[{"status":"affected","version":"2.6.0"},{"status":"affected","version":"2.6.1"},{"status":"affected","version":"2.6.2"},{"status":"affected","version":"2.6.3"},{"status":"affected","version":"2.6.4"},{"status":"unaffected","version":"2.6.5"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component."}],"id":"CVE-2026-125087","lastModified":"2026-11-12T19:16:53.200","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125087","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:38.997464Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:19.860","references":[{"source":"cna@vuldb.com","url":"https://github.com/Michael-A-Kuykendall/shimmy/"},{"source":"cna@vuldb.com","url":"https://github.com/Michael-A-Kuykendall/shimmy/commit/3f2ee748c02eeb229987913fe289a2ed9a24595d"},{"source":"cna@vuldb.com","url":"https://github.com/Michael-A-Kuykendall/shimmy/issues/221"},{"source":"cna@vuldb.com","url":"https://github.com/Michael-A-Kuykendall/shimmy/releases/tag/v2.6.5"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-125087"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1042415"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433198"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433198/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125095.json b/data/2026/CVE-2026-125095.json index ab93d30d21..a7570437c6 100644 --- a/data/2026/CVE-2026-125095.json +++ b/data/2026/CVE-2026-125095.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw_n_color() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents."}],"id":"CVE-2026-125095","lastModified":"2026-11-10T21:46:31.037","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125095","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:02:42.990015Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:50.287","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/c93.c#L198"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/ac0106851a4dac555c967421dfc96c0135183133"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-c93-decoder-uninitialized-stack-memory-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw_n_color() writes uninitialized stack bytes into decoded frames, disclosing stack memory contents."}],"id":"CVE-2026-125095","lastModified":"2026-11-10T21:46:31.037","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125095","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:02:42.990015Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:50.287","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/c93.c#L198"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/ac0106851a4dac555c967421dfc96c0135183133"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-c93-decoder-uninitialized-stack-memory-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125096.json b/data/2026/CVE-2026-125096.json index 79dee1a292..4f36c4fbbd 100644 --- a/data/2026/CVE-2026-125096.json +++ b/data/2026/CVE-2026-125096.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seq_decode_op1() copies an uninitialized 64-byte stack block into decoded frames, exposing stack memory in visible output."}],"id":"CVE-2026-125096","lastModified":"2026-11-10T21:46:25.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:50.437","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/tiertexseqv.c#L94"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/c896bbb24535685509a816af09665cb73bf2d0c7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-tiertex-seq-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seq_decode_op1() copies an uninitialized 64-byte stack block into decoded frames, exposing stack memory in visible output."}],"id":"CVE-2026-125096","lastModified":"2026-11-10T21:46:25.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:50.437","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/tiertexseqv.c#L94"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/c896bbb24535685509a816af09665cb73bf2d0c7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-tiertex-seq-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125097.json b/data/2026/CVE-2026-125097.json index 58f9a86286..d516455685 100644 --- a/data/2026/CVE-2026-125097.json +++ b/data/2026/CVE-2026-125097.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output."}],"id":"CVE-2026-125097","lastModified":"2026-11-10T21:46:30.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:50.580","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/rawdec.c#L208"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/01a395b935b9da12dbeca588a7130c4db6a14689"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-via-rawdec-c-raw-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output."}],"id":"CVE-2026-125097","lastModified":"2026-11-10T21:46:30.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:50.580","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/rawdec.c#L208"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/01a395b935b9da12dbeca588a7130c4db6a14689"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-via-rawdec-c-raw-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125098.json b/data/2026/CVE-2026-125098.json index 4e85bd1546..23331acf1b 100644 --- a/data/2026/CVE-2026-125098.json +++ b/data/2026/CVE-2026-125098.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width * height to disclose stale pixel data from previously decoded frames."}],"id":"CVE-2026-125098","lastModified":"2026-11-10T21:46:35.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125098","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:01.042795Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:50.720","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/webp.c#L1257"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/92b318e0b33623720d9f128ad7bc5fa8277c34f7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-webp-decoder-information-disclosure-via-short-alph-chunk"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width * height to disclose stale pixel data from previously decoded frames."}],"id":"CVE-2026-125098","lastModified":"2026-11-10T21:46:35.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125098","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:01.042795Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:50.720","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/webp.c#L1257"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/92b318e0b33623720d9f128ad7bc5fa8277c34f7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-webp-decoder-information-disclosure-via-short-alph-chunk"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125099.json b/data/2026/CVE-2026-125099.json index d5bca34338..2cfab1992e 100644 --- a/data/2026/CVE-2026-125099.json +++ b/data/2026/CVE-2026-125099.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents."}],"id":"CVE-2026-125099","lastModified":"2026-11-10T21:46:41.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125099","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:03:13.829429Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:50.873","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/gemdec.c#L258"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/e578999fa3c5f7efac1ea70bb7c2a7682013c7c9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-gem-raster-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into decoded frames, disclosing heap contents."}],"id":"CVE-2026-125099","lastModified":"2026-11-10T21:46:41.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125099","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:03:13.829429Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:50.873","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/gemdec.c#L258"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/e578999fa3c5f7efac1ea70bb7c2a7682013c7c9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-gem-raster-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125100.json b/data/2026/CVE-2026-125100.json index 7b4983ab7b..c0634d223c 100644 --- a/data/2026/CVE-2026-125100.json +++ b/data/2026/CVE-2026-125100.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode_frame() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized memory or stale frame data."}],"id":"CVE-2026-125100","lastModified":"2026-11-10T21:46:30.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:51.020","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/exr.c#L2219"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/c05d46ea2919da83233bf4216d3f58428bb54c59"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-integer-overflow-in-openexr-decoder-tile-count"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode_frame() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized memory or stale frame data."}],"id":"CVE-2026-125100","lastModified":"2026-11-10T21:46:30.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:51.020","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/exr.c#L2219"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/c05d46ea2919da83233bf4216d3f58428bb54c59"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-integer-overflow-in-openexr-decoder-tile-count"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125101.json b/data/2026/CVE-2026-125101.json index ecf41c66a0..c924fae605 100644 --- a/data/2026/CVE-2026-125101.json +++ b/data/2026/CVE-2026-125101.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output."}],"id":"CVE-2026-125101","lastModified":"2026-11-10T21:46:33.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:51.177","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25716"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vmnc.c#L348"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/50865f20b1f474e6b11735c88f668751bc9aa528"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vmnc-decoder-uninitialized-heap-memory-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output."}],"id":"CVE-2026-125101","lastModified":"2026-11-10T21:46:33.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:51.177","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25716"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vmnc.c#L348"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/50865f20b1f474e6b11735c88f668751bc9aa528"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vmnc-decoder-uninitialized-heap-memory-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125102.json b/data/2026/CVE-2026-125102.json index eec8584e63..1a951c97e4 100644 --- a/data/2026/CVE-2026-125102.json +++ b/data/2026/CVE-2026-125102.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded sample buffers to leak heap memory through decoded audio."}],"id":"CVE-2026-125102","lastModified":"2026-11-10T21:46:31.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125102","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:04.863133Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:51.333","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25703"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/takdec.c#L836"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/01e1bb126179879201429952cc2dcaea0d50d603"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-tak-decoder-uninitialized-memory-disclosure-via-takdec-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded sample buffers to leak heap memory through decoded audio."}],"id":"CVE-2026-125102","lastModified":"2026-11-10T21:46:31.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125102","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:04.863133Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:51.333","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25703"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/takdec.c#L836"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/01e1bb126179879201429952cc2dcaea0d50d603"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-tak-decoder-uninitialized-memory-disclosure-via-takdec-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125103.json b/data/2026/CVE-2026-125103.json index cfc263f284..0a4ce0ec7e 100644 --- a/data/2026/CVE-2026-125103.json +++ b/data/2026/CVE-2026-125103.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized heap bytes into decoded audio output."}],"id":"CVE-2026-125103","lastModified":"2026-11-10T21:46:35.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125103","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:46:21.422720Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:51.480","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25703"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mlz.c#L161"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/db98784a72600a94f7ebd5f016a37e01a505c27b"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-disclosure-via-mlz-decompressor-in-als-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized heap bytes into decoded audio output."}],"id":"CVE-2026-125103","lastModified":"2026-11-10T21:46:35.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125103","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:46:21.422720Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:51.480","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25703"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mlz.c#L161"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/db98784a72600a94f7ebd5f016a37e01a505c27b"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-disclosure-via-mlz-decompressor-in-als-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125104.json b/data/2026/CVE-2026-125104.json index b1d983815f..89cf7e4b56 100644 --- a/data/2026/CVE-2026-125104.json +++ b/data/2026/CVE-2026-125104.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service."}],"id":"CVE-2026-125104","lastModified":"2026-11-10T21:46:36.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125104","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:04:20.478105Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:51.627","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25703"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/apedec.c#L1601"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/968e9e948ed8c9ba90dbc875e60b843c755cf4ba"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-exhaustion-dos-via-ape-decoder-apedec-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service."}],"id":"CVE-2026-125104","lastModified":"2026-11-10T21:46:36.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125104","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:04:20.478105Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:51.627","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25703"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/apedec.c#L1601"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/968e9e948ed8c9ba90dbc875e60b843c755cf4ba"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-exhaustion-dos-via-ape-decoder-apedec-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125106.json b/data/2026/CVE-2026-125106.json index 47a5ef7ef1..68fdd6e40b 100644 --- a/data/2026/CVE-2026-125106.json +++ b/data/2026/CVE-2026-125106.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"wagtail","vendor":"wagtail","versions":[{"status":"affected","version":"< 7.0.9"},{"status":"affected","version":">= 7.1, < 7.3.4"},{"status":"affected","version":">= 7.4, < 7.4.3"},{"status":"affected","version":"= 8.0rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."}],"id":"CVE-2026-125106","lastModified":"2026-11-09T22:18:41.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:41.660","references":[{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/1fcf3ce3dbd6cfd54980a28fd61bd1de03ce819d"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/344ef54f6c2fa8c03921125ee46697d319fdc652"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/3c28e5ac3b1cd12eeb9a3a23e0949e7786305b2e"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/ac853cfb575ccd6868e7454f26064b8f3daabd4a"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.3.4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v8.0rc2"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"wagtail","vendor":"wagtail","versions":[{"status":"affected","version":"< 7.0.9"},{"status":"affected","version":">= 7.1, < 7.3.4"},{"status":"affected","version":">= 7.4, < 7.4.3"},{"status":"affected","version":"= 8.0rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."}],"id":"CVE-2026-125106","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:41.660","references":[{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/1fcf3ce3dbd6cfd54980a28fd61bd1de03ce819d"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/344ef54f6c2fa8c03921125ee46697d319fdc652"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/3c28e5ac3b1cd12eeb9a3a23e0949e7786305b2e"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/ac853cfb575ccd6868e7454f26064b8f3daabd4a"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.3.4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v8.0rc2"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125108.json b/data/2026/CVE-2026-125108.json index e528113598..951f9b10ab 100644 --- a/data/2026/CVE-2026-125108.json +++ b/data/2026/CVE-2026-125108.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":"< 2.2.25"},{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."}],"id":"CVE-2026-125108","lastModified":"2026-11-09T22:18:41.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:41.963","references":[{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v2.2.25"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.1.23"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.2.8"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":"< 2.2.25"},{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."}],"id":"CVE-2026-125108","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:41.963","references":[{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v2.2.25"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.1.23"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.2.8"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125109.json b/data/2026/CVE-2026-125109.json index 683398d628..f8f0fec4fd 100644 --- a/data/2026/CVE-2026-125109.json +++ b/data/2026/CVE-2026-125109.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8."}],"id":"CVE-2026-125109","lastModified":"2026-11-10T17:17:26.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125109","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:17:53.102307Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:42.127","references":[{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/4380381a56dc52556a436d6d794c8e18dc8b0565"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/49386f460286b7346c7003b69a839de782cc8a39"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.1.23"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.2.8"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1286"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8."}],"id":"CVE-2026-125109","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125109","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:17:53.102307Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:42.127","references":[{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/4380381a56dc52556a436d6d794c8e18dc8b0565"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/49386f460286b7346c7003b69a839de782cc8a39"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.1.23"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.2.8"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1286"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125110.json b/data/2026/CVE-2026-125110.json index 4ab7e6cf7b..4c18082103 100644 --- a/data/2026/CVE-2026-125110.json +++ b/data/2026/CVE-2026-125110.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":"< 2.2.25"},{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encoded dot segments and receive it without path-specific security headers such as Content-Disposition or Content-Security-Policy. Applications that do not use path-specific header_rules are not affected. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."}],"id":"CVE-2026-125110","lastModified":"2026-11-09T22:18:42.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:42.287","references":[{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/18a07fe553afb4d8a678d6a948cd6ba1e11e28be"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/9d7f19484ffd5ed5e032678c26ee6eff96d3a0a3"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/e88097ccb88be44d06d47b42daffe04929516ee4"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-180"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":"< 2.2.25"},{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encoded dot segments and receive it without path-specific security headers such as Content-Disposition or Content-Security-Policy. Applications that do not use path-specific header_rules are not affected. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."}],"id":"CVE-2026-125110","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:42.287","references":[{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/18a07fe553afb4d8a678d6a948cd6ba1e11e28be"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/9d7f19484ffd5ed5e032678c26ee6eff96d3a0a3"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/e88097ccb88be44d06d47b42daffe04929516ee4"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-180"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125111.json b/data/2026/CVE-2026-125111.json index f9300f5e65..77c5d9acd1 100644 --- a/data/2026/CVE-2026-125111.json +++ b/data/2026/CVE-2026-125111.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":"< 2.2.25"},{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with rack.multipart.buffer_size boundaries so the buffer grows with the request despite per-field, header, and preamble limits, causing a worker to exhaust memory. The attack requires only a well-formed multipart body and affects applications that parse multipart requests. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."}],"id":"CVE-2026-125111","lastModified":"2026-11-09T22:18:42.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:42.433","references":[{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/244e75a840cee0823f86d5d01dc374505a8abed8"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/2eaa5b1026a03a43b6537b1a0b233707ba887702"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/c9b4698595050838342bd3b5a0fc9ab908065f8f"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":"< 2.2.25"},{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with rack.multipart.buffer_size boundaries so the buffer grows with the request despite per-field, header, and preamble limits, causing a worker to exhaust memory. The attack requires only a well-formed multipart body and affects applications that parse multipart requests. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."}],"id":"CVE-2026-125111","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125111","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:33.895886Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:42.433","references":[{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/244e75a840cee0823f86d5d01dc374505a8abed8"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/2eaa5b1026a03a43b6537b1a0b233707ba887702"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/c9b4698595050838342bd3b5a0fc9ab908065f8f"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125116.json b/data/2026/CVE-2026-125116.json index ca50201f38..3e1b661d74 100644 --- a/data/2026/CVE-2026-125116.json +++ b/data/2026/CVE-2026-125116.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.12"},{"status":"affected","version":">= 7.0.0, < 7.8.13"},{"status":"affected","version":">= 8.0.0, < 8.24.7"},{"status":"affected","version":">= 9.0.0, < 9.11.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can therefore resolve to inherited built-in functions instead of a registered discriminator, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting or strict filtering, and a stored poisoned document can make every query that hydrates it fail until the document is removed. The weakness reads inherited properties but does not modify Object.prototype and is not prototype pollution. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."}],"id":"CVE-2026-125116","lastModified":"2026-11-09T23:17:21.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T23:17:21.907","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/0ecd8040d9b446f36535d79938c130c800f91766"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/18afab75bea861f625b7c5b54635c84567ec566c"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/390453c8ce1b36b6cfd1e63432a910da1f3d81d5"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b26c43554233134ea978c5852babe13be858b2cf"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b68f90734b50cd22c89a669c8ca1469d7234b296"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.12"},{"status":"affected","version":">= 7.0.0, < 7.8.13"},{"status":"affected","version":">= 8.0.0, < 8.24.7"},{"status":"affected","version":">= 9.0.0, < 9.11.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can therefore resolve to inherited built-in functions instead of a registered discriminator, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting or strict filtering, and a stored poisoned document can make every query that hydrates it fail until the document is removed. The weakness reads inherited properties but does not modify Object.prototype and is not prototype pollution. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."}],"id":"CVE-2026-125116","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T23:17:21.907","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/0ecd8040d9b446f36535d79938c130c800f91766"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/18afab75bea861f625b7c5b54635c84567ec566c"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/390453c8ce1b36b6cfd1e63432a910da1f3d81d5"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b26c43554233134ea978c5852babe13be858b2cf"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b68f90734b50cd22c89a669c8ca1469d7234b296"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125117.json b/data/2026/CVE-2026-125117.json index e1ed6d0701..d6e1592ff0 100644 --- a/data/2026/CVE-2026-125117.json +++ b/data/2026/CVE-2026-125117.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.12"},{"status":"affected","version":">= 7.0.0, < 7.8.13"},{"status":"affected","version":">= 8.0.0, < 8.24.7"},{"status":"affected","version":">= 9.0.0, < 9.11.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can therefore cause Mongoose to write into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or Query.prototype.merge() source can overwrite Object.prototype.toString.call, causing later queries on unrelated models to fail until the process restarts. Separately, when an attacker controls the dotted path passed to doc.set(path, value) for a subdocument configured with strict: false, descent through $__set can reach $__schema and alter shared validators or schema options for later documents. Mongoose already blocks __proto__, constructor, and prototype, so this issue overwrites properties on reachable shared objects rather than adding new properties directly to Object.prototype. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."}],"id":"CVE-2026-125117","lastModified":"2026-11-10T17:17:26.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125117","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:20:05.167833Z","version":"2.0.3"}}]},"published":"2026-11-09T23:17:22.080","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/18b5513dd463731a2caf0d3395ef1d9eb0735f50"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/2a195d19a4dd240f039a0a226614d5804e8187ee"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/3cb702b8d079c3e267f0b10f41673a1590f703c8"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/85cf897105edfeb5f56be42a18a68704434cac82"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8eb74cb4a550cbe0225963b07aebacbd999d4b74"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.12"},{"status":"affected","version":">= 7.0.0, < 7.8.13"},{"status":"affected","version":">= 8.0.0, < 8.24.7"},{"status":"affected","version":">= 9.0.0, < 9.11.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can therefore cause Mongoose to write into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or Query.prototype.merge() source can overwrite Object.prototype.toString.call, causing later queries on unrelated models to fail until the process restarts. Separately, when an attacker controls the dotted path passed to doc.set(path, value) for a subdocument configured with strict: false, descent through $__set can reach $__schema and alter shared validators or schema options for later documents. Mongoose already blocks __proto__, constructor, and prototype, so this issue overwrites properties on reachable shared objects rather than adding new properties directly to Object.prototype. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."}],"id":"CVE-2026-125117","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125117","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:20:05.167833Z","version":"2.0.3"}}]},"published":"2026-11-09T23:17:22.080","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/18b5513dd463731a2caf0d3395ef1d9eb0735f50"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/2a195d19a4dd240f039a0a226614d5804e8187ee"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/3cb702b8d079c3e267f0b10f41673a1590f703c8"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/85cf897105edfeb5f56be42a18a68704434cac82"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8eb74cb4a550cbe0225963b07aebacbd999d4b74"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-8332-j7wj-wjw4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125118.json b/data/2026/CVE-2026-125118.json index e750403bc0..ab98f883c4 100644 --- a/data/2026/CVE-2026-125118.json +++ b/data/2026/CVE-2026-125118.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.12"},{"status":"affected","version":">= 7.0.0, < 7.8.13"},{"status":"affected","version":">= 8.0.0, < 8.24.7"},{"status":"affected","version":">= 9.0.0, < 9.11.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by Schema.path() and Schema.add(). An attacker who can influence virtual field names in dynamic schemas, content-management form builders, or schema-as-code systems can supply path segments such as __proto__, constructor, or prototype, causing the virtual-path reducer to write enumerable properties to Object.prototype or Function.prototype. The resulting prototype pollution can spoof inherited property checks such as authorization flags and can provide function-prototype gadget state to other server-side JavaScript code. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."}],"id":"CVE-2026-125118","lastModified":"2026-11-09T23:17:22.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T23:17:22.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/318f7e09dd363a1dfddb8180878488dccd2796d1"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/74df7769b5a8d89c4413b764029911ee915ea467"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/7a2a6567abbb72c0430c8cc5b7942141844fecff"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/fb467e6d33174293dc0360649f20ce68d99117a9"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-6972-9mcm-vhwj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.12"},{"status":"affected","version":">= 7.0.0, < 7.8.13"},{"status":"affected","version":">= 8.0.0, < 8.24.7"},{"status":"affected","version":">= 9.0.0, < 9.11.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by Schema.path() and Schema.add(). An attacker who can influence virtual field names in dynamic schemas, content-management form builders, or schema-as-code systems can supply path segments such as __proto__, constructor, or prototype, causing the virtual-path reducer to write enumerable properties to Object.prototype or Function.prototype. The resulting prototype pollution can spoof inherited property checks such as authorization flags and can provide function-prototype gadget state to other server-side JavaScript code. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."}],"id":"CVE-2026-125118","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T23:17:22.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/318f7e09dd363a1dfddb8180878488dccd2796d1"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/74df7769b5a8d89c4413b764029911ee915ea467"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/7a2a6567abbb72c0430c8cc5b7942141844fecff"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/fb467e6d33174293dc0360649f20ce68d99117a9"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-6972-9mcm-vhwj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125119.json b/data/2026/CVE-2026-125119.json index 3d8d74bfc5..cd74744924 100644 --- a/data/2026/CVE-2026-125119.json +++ b/data/2026/CVE-2026-125119.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":">= 6.0.0, < 6.13.12"},{"status":"affected","version":">= 7.0.0, < 7.8.13"},{"status":"affected","version":">= 8.0.0, < 8.24.7"},{"status":"affected","version":">= 9.0.0, < 9.11.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."}],"id":"CVE-2026-125119","lastModified":"2026-11-09T23:17:22.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T23:17:22.397","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/4bb659478be2f30655a7bdd78bc251bdf111cd29"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/4f4f9a79f860786a54133bee2c9af967ec691491"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/83eda6af1489e9ef60bb8eee8cf9ee005771b9d5"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b8970c25998c23fbccd17f76c0398b902ff4911d"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-943"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":">= 6.0.0, < 6.13.12"},{"status":"affected","version":">= 7.0.0, < 7.8.13"},{"status":"affected","version":">= 8.0.0, < 8.24.7"},{"status":"affected","version":">= 9.0.0, < 9.11.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype._castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."}],"id":"CVE-2026-125119","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125119","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:36.614464Z","version":"2.0.3"}}]},"published":"2026-11-09T23:17:22.397","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/4bb659478be2f30655a7bdd78bc251bdf111cd29"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/4f4f9a79f860786a54133bee2c9af967ec691491"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/83eda6af1489e9ef60bb8eee8cf9ee005771b9d5"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b8970c25998c23fbccd17f76c0398b902ff4911d"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-gg4r-jv3p-qx3c"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-943"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125120.json b/data/2026/CVE-2026-125120.json index 37b502322b..0cbb8fab26 100644 --- a/data/2026/CVE-2026-125120.json +++ b/data/2026/CVE-2026-125120.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.11"},{"status":"affected","version":">= 7.0.0, < 7.8.12"},{"status":"affected","version":">= 8.0.0, < 8.24.3"},{"status":"affected","version":">= 9.0.0, < 9.9.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2."}],"id":"CVE-2026-125120","lastModified":"2026-11-09T23:17:22.587","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T23:17:22.587","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.11"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.3"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.9.2"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-943"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.11"},{"status":"affected","version":">= 7.0.0, < 7.8.12"},{"status":"affected","version":">= 8.0.0, < 8.24.3"},{"status":"affected","version":">= 9.0.0, < 9.9.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2."}],"id":"CVE-2026-125120","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T23:17:22.587","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.11"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.3"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.9.2"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-943"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125121.json b/data/2026/CVE-2026-125121.json index 2daf75c507..5372df3c2b 100644 --- a/data/2026/CVE-2026-125121.json +++ b/data/2026/CVE-2026-125121.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"compose-lint","vendor":"tmatens","versions":[{"status":"affected","version":">= 0.31.0, < 0.32.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0."}],"id":"CVE-2026-125121","lastModified":"2026-11-10T17:17:26.410","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T17:17:26.410","references":[{"source":"security-advisories@github.com","url":"https://github.com/advisories/GHSA-6f4g-xm8v-pgv6"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/pull/945"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"},{"lang":"en","value":"CWE-150"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"compose-lint","vendor":"tmatens","versions":[{"status":"affected","version":">= 0.31.0, < 0.32.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0."}],"id":"CVE-2026-125121","lastModified":"2026-11-12T19:16:53.673","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125121","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:51.109387Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:26.410","references":[{"source":"security-advisories@github.com","url":"https://github.com/advisories/GHSA-6f4g-xm8v-pgv6"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/pull/945"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"},{"lang":"en","value":"CWE-150"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125170.json b/data/2026/CVE-2026-125170.json index b39a41998a..70a9353a22 100644 --- a/data/2026/CVE-2026-125170.json +++ b/data/2026/CVE-2026-125170.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targa_decode_rle() in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap buffer data and replicated uninitialized stack bytes."}],"id":"CVE-2026-125170","lastModified":"2026-11-10T21:46:41.187","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:51.773","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24597"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/targa.c#L72"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f8f84348dfe1a80d38e7dbbcddcdd5d92a760dfd"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-targa-decode-rle"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targa_decode_rle() in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap buffer data and replicated uninitialized stack bytes."}],"id":"CVE-2026-125170","lastModified":"2026-11-10T21:46:41.187","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:51.773","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24597"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/targa.c#L72"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f8f84348dfe1a80d38e7dbbcddcdd5d92a760dfd"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-targa-decode-rle"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125171.json b/data/2026/CVE-2026-125171.json index bd1bc25e20..1eb96d8694 100644 --- a/data/2026/CVE-2026-125171.json +++ b/data/2026/CVE-2026-125171.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure."}],"id":"CVE-2026-125171","lastModified":"2026-11-10T21:46:33.777","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125171","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:07.126806Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:51.920","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25074"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mpc7.c#L281"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/5d59b7c45d7142bddd13ddc8891e72c5c7dc991b"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-in-musepack-sv7-decoder-via-mpc7-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7_decode_init() does not validate lastframelen against MPC_FRAME_SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure."}],"id":"CVE-2026-125171","lastModified":"2026-11-10T21:46:33.777","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125171","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:07.126806Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:51.920","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25074"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mpc7.c#L281"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/5d59b7c45d7142bddd13ddc8891e72c5c7dc991b"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-in-musepack-sv7-decoder-via-mpc7-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125172.json b/data/2026/CVE-2026-125172.json index f4b89ef49b..963d5001af 100644 --- a/data/2026/CVE-2026-125172.json +++ b/data/2026/CVE-2026-125172.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"7.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read past the packet buffer, crashing the application or exposing adjacent heap memory."}],"id":"CVE-2026-125172","lastModified":"2026-11-10T21:46:31.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125172","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:54:03.705419Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.073","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libxevd.c#L355"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/e06b3953d4253f8b56271628ba4083fde96aeadb"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-libxevd-evc-nal-length"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"7.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read past the packet buffer, crashing the application or exposing adjacent heap memory."}],"id":"CVE-2026-125172","lastModified":"2026-11-10T21:46:31.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125172","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:54:03.705419Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.073","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libxevd.c#L355"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/e06b3953d4253f8b56271628ba4083fde96aeadb"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-libxevd-evc-nal-length"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125173.json b/data/2026/CVE-2026-125173.json index 910c6e4df6..8ca9d4db4e 100644 --- a/data/2026/CVE-2026-125173.json +++ b/data/2026/CVE-2026-125173.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"7.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to free pkt_au when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units to exhaust memory in the decoding application."}],"id":"CVE-2026-125173","lastModified":"2026-11-10T21:46:33.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125173","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:04:04.608934Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.230","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libxevd.c#L341"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/250303c2a59a71bfc544a6b583bc17b6cf0ca903"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-in-libxevd-evc-decoder-wrapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"7.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c that fails to free pkt_au when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units to exhaust memory in the decoding application."}],"id":"CVE-2026-125173","lastModified":"2026-11-10T21:46:33.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125173","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:04:04.608934Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.230","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libxevd.c#L341"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/250303c2a59a71bfc544a6b583bc17b6cf0ca903"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-in-libxevd-evc-decoder-wrapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125174.json b/data/2026/CVE-2026-125174.json index 3ec249ee26..98749efd96 100644 --- a/data/2026/CVE-2026-125174.json +++ b/data/2026/CVE-2026-125174.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThan":"8.1.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"9.0.2","status":"affected","version":"9.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff_hap_set_chunk_count() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes through a NULL chunk table, crashing the application."}],"id":"CVE-2026-125174","lastModified":"2026-11-10T21:46:26.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:03:47.956476Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.380","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24487"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/hap.c#L33"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f8c4c6400e835bf65e8b9cc12aba9e5c4d1c818c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-null-pointer-dereference-via-ff-hap-set-chunk-count"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThan":"8.1.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"9.0.2","status":"affected","version":"9.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff_hap_set_chunk_count() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes through a NULL chunk table, crashing the application."}],"id":"CVE-2026-125174","lastModified":"2026-11-10T21:46:26.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:03:47.956476Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.380","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24487"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/hap.c#L33"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f8c4c6400e835bf65e8b9cc12aba9e5c4d1c818c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-null-pointer-dereference-via-ff-hap-set-chunk-count"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125175.json b/data/2026/CVE-2026-125175.json index 53af9e8448..069066e0b7 100644 --- a/data/2026/CVE-2026-125175.json +++ b/data/2026/CVE-2026-125175.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses short, then recover heap contents from the decoded or re-encoded output."}],"id":"CVE-2026-125175","lastModified":"2026-11-10T21:46:31.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:09.494011Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.527","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24464"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/flashsv.c#L248"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/50d206a75b5e60261d71b25657ae04891eb60290"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/cfb40c912927fdd2c1186b7b6aca468422da23db"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-information-disclosure-via-flash-screen-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 stream whose zlib block data decompresses short, then recover heap contents from the decoded or re-encoded output."}],"id":"CVE-2026-125175","lastModified":"2026-11-10T21:46:31.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:09.494011Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.527","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24464"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/flashsv.c#L248"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/50d206a75b5e60261d71b25657ae04891eb60290"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/cfb40c912927fdd2c1186b7b6aca468422da23db"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-information-disclosure-via-flash-screen-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125176.json b/data/2026/CVE-2026-125176.json index 77acaa96e4..3a4e14817c 100644 --- a/data/2026/CVE-2026-125176.json +++ b/data/2026/CVE-2026-125176.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decode_hybrid() in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated data ends mid-pixel to leak heap memory into decoded output frames."}],"id":"CVE-2026-125176","lastModified":"2026-11-10T21:46:41.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:55:33.667036Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.673","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24474"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/flashsv.c#L89"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/16d0f7f408ba47b4091a22109d4f22f5fd57820a"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-read-in-flash-screen-video-2-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decode_hybrid() in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated data ends mid-pixel to leak heap memory into decoded output frames."}],"id":"CVE-2026-125176","lastModified":"2026-11-10T21:46:41.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:55:33.667036Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.673","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24474"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/flashsv.c#L89"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/16d0f7f408ba47b4091a22109d4f22f5fd57820a"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-read-in-flash-screen-video-2-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125177.json b/data/2026/CVE-2026-125177.json index ca79b7ba40..3af678012a 100644 --- a/data/2026/CVE-2026-125177.json +++ b/data/2026/CVE-2026-125177.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame exposes leftover heap memory to viewers of the output."}],"id":"CVE-2026-125177","lastModified":"2026-11-10T21:46:36.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:52.823","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24465"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mscc.c#L236"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/263a85e2a2127396f8a2b0c329ec798e1ea015ad"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-via-mscc-srgc-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data terminates early so the decoded frame exposes leftover heap memory to viewers of the output."}],"id":"CVE-2026-125177","lastModified":"2026-11-10T21:46:36.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:52.823","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24465"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mscc.c#L236"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/263a85e2a2127396f8a2b0c329ec798e1ea015ad"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-via-mscc-srgc-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125178.json b/data/2026/CVE-2026-125178.json index e529049c91..239f45e268 100644 --- a/data/2026/CVE-2026-125178.json +++ b/data/2026/CVE-2026-125178.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_paint_cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames."}],"id":"CVE-2026-125178","lastModified":"2026-11-10T21:46:25.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:52.973","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24682"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/tdsc.c#L207"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/12c589a37d093cc55618f8377b092dc21416806f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-heap-read-via-tdsc-cursor-dimensions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_paint_cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames."}],"id":"CVE-2026-125178","lastModified":"2026-11-10T21:46:25.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:52.973","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24682"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/tdsc.c#L207"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/12c589a37d093cc55618f8377b092dc21416806f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-heap-read-via-tdsc-cursor-dimensions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125179.json b/data/2026/CVE-2026-125179.json index 1160b468ba..05f8a31ae4 100644 --- a/data/2026/CVE-2026-125179.json +++ b/data/2026/CVE-2026-125179.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing vqa_decode_frame() to render frames from leftover heap bytes visible in decoded output."}],"id":"CVE-2026-125179","lastModified":"2026-11-10T21:46:37.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:11.949570Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:53.117","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24670"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vqavideo.c#L186"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f9df3577ac40aaee06f82f05eab8249cbab3cd33"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-memory-disclosure-via-vqa-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing vqa_decode_frame() to render frames from leftover heap bytes visible in decoded output."}],"id":"CVE-2026-125179","lastModified":"2026-11-10T21:46:37.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:11.949570Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:53.117","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24670"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vqavideo.c#L186"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f9df3577ac40aaee06f82f05eab8249cbab3cd33"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-memory-disclosure-via-vqa-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125180.json b/data/2026/CVE-2026-125180.json index 9e897c0839..7196ba0058 100644 --- a/data/2026/CVE-2026-125180.json +++ b/data/2026/CVE-2026-125180.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"8.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications."}],"id":"CVE-2026-125180","lastModified":"2026-11-10T21:46:26.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125180","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:03:32.437631Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:53.287","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/exif.c#L274"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/30fff47764e59f02ac7868bb832ed51a88f949fd"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-exif-parser-memory-exhaustion-via-overlapping-tags"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"8.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger quadratic memory allocation, causing denial of service in decoding applications."}],"id":"CVE-2026-125180","lastModified":"2026-11-10T21:46:26.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125180","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:03:32.437631Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:53.287","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/exif.c#L274"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/30fff47764e59f02ac7868bb832ed51a88f949fd"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-exif-parser-memory-exhaustion-via-overlapping-tags"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125181.json b/data/2026/CVE-2026-125181.json index 97d3221555..66bcef388d 100644 --- a/data/2026/CVE-2026-125181.json +++ b/data/2026/CVE-2026-125181.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic_decode_frame_15_16BPP() in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLI_BRUN chunk whose non-terminating byte-swap loop writes packet-derived data past the frame buffer, crashing the process."}],"id":"CVE-2026-125181","lastModified":"2026-11-10T21:46:30.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:53.437","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24901"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/flicvideo.c#L883"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/c0d308a9a616f4abcc4e0a4d86f7de92ecdef9f6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/eb47d7bb6cf13042c6ab14e22fc0c0c3a6e51e12"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/ee30fb98c0d4e97abbd5e371d2a3a926e92bec70"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-flic-decoder-out-of-bounds-write-via-fli-brun-byte-swap"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic_decode_frame_15_16BPP() in libavcodec/flicvideo.c that allows attackers to corrupt heap memory on big-endian builds. Attackers can supply a crafted 15/16 bpp FLIC/FLX file with an FLI_BRUN chunk whose non-terminating byte-swap loop writes packet-derived data past the frame buffer, crashing the process."}],"id":"CVE-2026-125181","lastModified":"2026-11-10T21:46:30.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:53.437","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24901"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/flicvideo.c#L883"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/c0d308a9a616f4abcc4e0a4d86f7de92ecdef9f6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/eb47d7bb6cf13042c6ab14e22fc0c0c3a6e51e12"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/ee30fb98c0d4e97abbd5e371d2a3a926e92bec70"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-flic-decoder-out-of-bounds-write-via-fli-brun-byte-swap"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125182.json b/data/2026/CVE-2026-125182.json index 9cf73cbbe9..0189ac1d26 100644 --- a/data/2026/CVE-2026-125182.json +++ b/data/2026/CVE-2026-125182.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode_buffer_0, leaking pointers and decoder state into decoded audio to help defeat ASLR."}],"id":"CVE-2026-125182","lastModified":"2026-11-10T21:46:30.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:53.587","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24763"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cook.c#L854"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/7145d13201c9f9c5253f40295714faa4f4ada1a0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-cook-decoder-js-subband-start"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode_buffer_0, leaking pointers and decoder state into decoded audio to help defeat ASLR."}],"id":"CVE-2026-125182","lastModified":"2026-11-10T21:46:30.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:53.587","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24763"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cook.c#L854"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/7145d13201c9f9c5253f40295714faa4f4ada1a0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-cook-decoder-js-subband-start"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125183.json b/data/2026/CVE-2026-125183.json index ead851e42e..41f2563c05 100644 --- a/data/2026/CVE-2026-125183.json +++ b/data/2026/CVE-2026-125183.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe."}],"id":"CVE-2026-125183","lastModified":"2026-11-10T21:46:26.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:03:16.271412Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:53.733","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hevc/ps.c#L1963"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f9f732b444a2fc27dcc4fe52084d3d435f827864"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-denial-of-service-via-hevc-pps-3d-extension-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-834"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit skips, stalling decoders, parsers, and ffprobe."}],"id":"CVE-2026-125183","lastModified":"2026-11-10T21:46:26.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:03:16.271412Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:53.733","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hevc/ps.c#L1963"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f9f732b444a2fc27dcc4fe52084d3d435f827864"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-denial-of-service-via-hevc-pps-3d-extension-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-834"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125184.json b/data/2026/CVE-2026-125184.json index f0915d4430..60e2bc6eb1 100644 --- a/data/2026/CVE-2026-125184.json +++ b/data/2026/CVE-2026-125184.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"6.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CSCD stream whose LZO or zlib frames decompress to fewer bytes than the frame size, recovering heap contents from the decoded or re-encoded output."}],"id":"CVE-2026-125184","lastModified":"2026-11-10T21:46:42.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125184","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:56:34.762923Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:53.887","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25716"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cscd.c#L152"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/e58c4eb98f0f3c0523089fb9d037eedfcbd204d9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-6.1-through-9.0.2-information-disclosure-via-camstudio-decoder-cscd-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"6.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CSCD stream whose LZO or zlib frames decompress to fewer bytes than the frame size, recovering heap contents from the decoded or re-encoded output."}],"id":"CVE-2026-125184","lastModified":"2026-11-10T21:46:42.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125184","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:56:34.762923Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:53.887","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25716"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cscd.c#L152"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/e58c4eb98f0f3c0523089fb9d037eedfcbd204d9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-6.1-through-9.0.2-information-disclosure-via-camstudio-decoder-cscd-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125185.json b/data/2026/CVE-2026-125185.json index 5f84d0ad5c..43387a7d8f 100644 --- a/data/2026/CVE-2026-125185.json +++ b/data/2026/CVE-2026-125185.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_aom_parse_film_grain_sets() that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generate_scaling() to divide by zero and crash the decoder."}],"id":"CVE-2026-125185","lastModified":"2026-11-10T21:46:41.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:03:00.308514Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.030","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/aom_film_grain_template.c#L457"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/b8daf520dd03f6139aa053acb768f3c4594599d9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-division-by-zero-via-afgs1-film-grain-scaling-points"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_aom_parse_film_grain_sets() that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generate_scaling() to divide by zero and crash the decoder."}],"id":"CVE-2026-125185","lastModified":"2026-11-10T21:46:41.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:03:00.308514Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.030","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25572"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/aom_film_grain_template.c#L457"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/b8daf520dd03f6139aa053acb768f3c4594599d9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-division-by-zero-via-afgs1-film-grain-scaling-points"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125186.json b/data/2026/CVE-2026-125186.json index 3014269ead..65e4567331 100644 --- a/data/2026/CVE-2026-125186.json +++ b/data/2026/CVE-2026-125186.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating picture order counts, forcing h264_queue_frame() to allocate tree nodes per slice and deny service."}],"id":"CVE-2026-125186","lastModified":"2026-11-10T21:46:30.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125186","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:44.690664Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.180","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25569"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/bsf/dts2pts.c#L363"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/d8013c061725631261d7326c07d2af3a67fa4bc1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-cpu-exhaustion-via-dts2pts-bitstream-filter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 packet with many slices of alternating picture order counts, forcing h264_queue_frame() to allocate tree nodes per slice and deny service."}],"id":"CVE-2026-125186","lastModified":"2026-11-10T21:46:30.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125186","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:44.690664Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.180","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25569"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/bsf/dts2pts.c#L363"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/d8013c061725631261d7326c07d2af3a67fa4bc1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-cpu-exhaustion-via-dts2pts-bitstream-filter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125187.json b/data/2026/CVE-2026-125187.json index 03981329e2..c2cf8281c5 100644 --- a/data/2026/CVE-2026-125187.json +++ b/data/2026/CVE-2026-125187.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame, triggering the av_assert0() in flush_put_bits() and aborting applications transcoding to TTA."}],"id":"CVE-2026-125187","lastModified":"2026-11-10T21:46:30.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125187","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:28.982674Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.330","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25694"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/ttaenc.c#L93"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/29a629e788c4343ff2e923095b8f38769fe2e470"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-tta-encoder-reachable-assertion-via-tta-encode-frame"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame, triggering the av_assert0() in flush_put_bits() and aborting applications transcoding to TTA."}],"id":"CVE-2026-125187","lastModified":"2026-11-10T21:46:30.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125187","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:28.982674Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.330","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25694"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/ttaenc.c#L93"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/29a629e788c4343ff2e923095b8f38769fe2e470"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-tta-encoder-reachable-assertion-via-tta-encode-frame"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125188.json b/data/2026/CVE-2026-125188.json index 559fff00d6..ae3c64a9f6 100644 --- a/data/2026/CVE-2026-125188.json +++ b/data/2026/CVE-2026-125188.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresenc_anatoliy.c that occurs when the prores_aw encoder processes interlaced, odd-height frames. Attackers can supply odd-height video that causes subimage_with_fill_template() to fill padding rows from memory before the fill_y buffer, leaking heap contents into the encoded output."}],"id":"CVE-2026-125188","lastModified":"2026-11-10T21:46:37.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125188","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:48:41.029323Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.480","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24490"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/proresenc_anatoliy.c#L499"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/ad2287d6d2511af66222e8f7e40d546bc8d461ec"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/d74f5e0559ba09d942c47687856349b03c1115dd"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-prores-prores-aw-heap-out-of-bounds-read-in-interlaced-encoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-127"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresenc_anatoliy.c that occurs when the prores_aw encoder processes interlaced, odd-height frames. Attackers can supply odd-height video that causes subimage_with_fill_template() to fill padding rows from memory before the fill_y buffer, leaking heap contents into the encoded output."}],"id":"CVE-2026-125188","lastModified":"2026-11-10T21:46:37.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125188","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:48:41.029323Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.480","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24490"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/proresenc_anatoliy.c#L499"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/ad2287d6d2511af66222e8f7e40d546bc8d461ec"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/d74f5e0559ba09d942c47687856349b03c1115dd"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-prores-prores-aw-heap-out-of-bounds-read-in-interlaced-encoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-127"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125189.json b/data/2026/CVE-2026-125189.json index 70b98a5942..8269270d3c 100644 --- a/data/2026/CVE-2026-125189.json +++ b/data/2026/CVE-2026-125189.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"8.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a process block position mismatch in lcevc_metadata_handle_vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an av_assert0 failure in ff_cbs_lcevc_list_add(), aborting the application."}],"id":"CVE-2026-125189","lastModified":"2026-11-10T21:46:41.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125189","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:13.028798Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.630","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/bsf/lcevc_metadata.c#L103"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/0747459f0c6f228566f5cb11ceed56b977208582"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-denial-of-service-via-lcevc-metadata-bitstream-filter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"8.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in the lcevc_metadata bitstream filter caused by a process block position mismatch in lcevc_metadata_handle_vui(). Attackers can supply crafted LCEVC access units with two IDR or non-IDR NAL units to trigger an av_assert0 failure in ff_cbs_lcevc_list_add(), aborting the application."}],"id":"CVE-2026-125189","lastModified":"2026-11-10T21:46:41.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125189","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:13.028798Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.630","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25408"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/bsf/lcevc_metadata.c#L103"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/0747459f0c6f228566f5cb11ceed56b977208582"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-8.1-through-9.0.2-denial-of-service-via-lcevc-metadata-bitstream-filter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125190.json b/data/2026/CVE-2026-125190.json index ccf6be842f..1fdf25002a 100644 --- a/data/2026/CVE-2026-125190.json +++ b/data/2026/CVE-2026-125190.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames."}],"id":"CVE-2026-125190","lastModified":"2026-11-10T21:46:41.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:54.777","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25278"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mvcdec.c#L141"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/3a5eb948e76dc6390e4b3cff7becf84bc492b7af"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-stack-memory-disclosure-via-mvc2-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames."}],"id":"CVE-2026-125190","lastModified":"2026-11-10T21:46:41.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:54.777","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25278"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mvcdec.c#L141"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/3a5eb948e76dc6390e4b3cff7becf84bc492b7af"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-stack-memory-disclosure-via-mvc2-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125191.json b/data/2026/CVE-2026-125191.json index d882ff3161..cf1be4aec3 100644 --- a/data/2026/CVE-2026-125191.json +++ b/data/2026/CVE-2026-125191.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ff_v4l2_m2m_codec_reinit() wait forever and hang the decoding application."}],"id":"CVE-2026-125191","lastModified":"2026-11-10T21:46:36.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125191","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:01:56.596542Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.923","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/v4l2_buffers.c#L274"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/4d2d58efa9b9f3802893b1db0ea1edfbe1cc66ef"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-v4l2-m2m-decoder-deadlock-via-reference-count-leak"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-911"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ff_v4l2_m2m_codec_reinit() wait forever and hang the decoding application."}],"id":"CVE-2026-125191","lastModified":"2026-11-10T21:46:36.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125191","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:01:56.596542Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.923","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/v4l2_buffers.c#L274"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/4d2d58efa9b9f3802893b1db0ea1edfbe1cc66ef"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-v4l2-m2m-decoder-deadlock-via-reference-count-leak"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-911"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125192.json b/data/2026/CVE-2026-125192.json index 2ba13b8df2..0ea5afa703 100644 --- a/data/2026/CVE-2026-125192.json +++ b/data/2026/CVE-2026-125192.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames."}],"id":"CVE-2026-125192","lastModified":"2026-11-10T21:46:37.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:59:26.262868Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:55.070","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24463"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/dxa.c#L341"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/a6e5d5ff993a525933d8d8f29071eb6c74b0436a"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-memory-disclosure-via-dxa-decoder-uninitialized-buffer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized decomp_buf buffer into output pictures, exposing leftover heap contents in decoded frames."}],"id":"CVE-2026-125192","lastModified":"2026-11-10T21:46:37.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:59:26.262868Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:55.070","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24463"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/dxa.c#L341"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/a6e5d5ff993a525933d8d8f29071eb6c74b0436a"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-memory-disclosure-via-dxa-decoder-uninitialized-buffer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125193.json b/data/2026/CVE-2026-125193.json index dbd3781f4b..1adc48a037 100644 --- a/data/2026/CVE-2026-125193.json +++ b/data/2026/CVE-2026-125193.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it never verifies packets hold width * height * 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted SDP/RFC 4175 RTP sessions or raw input to crash applications or expose adjacent heap memory."}],"id":"CVE-2026-125193","lastModified":"2026-11-10T21:46:25.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:55.217","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25702"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/bitpacked_dec.c#L52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f1205ee01893a3b509d96b5fe3aeda755c517973"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-bitpacked-decode-uyvy422"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c because it never verifies packets hold width * height * 2 bytes. Attackers can supply truncated bitpacked UYVY422 packets via crafted SDP/RFC 4175 RTP sessions or raw input to crash applications or expose adjacent heap memory."}],"id":"CVE-2026-125193","lastModified":"2026-11-10T21:46:25.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:55.217","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25702"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/bitpacked_dec.c#L52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f1205ee01893a3b509d96b5fe3aeda755c517973"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-bitpacked-decode-uyvy422"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125194.json b/data/2026/CVE-2026-125194.json index 29b74767c4..1992e0f9b3 100644 --- a/data/2026/CVE-2026-125194.json +++ b/data/2026/CVE-2026-125194.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wrap and crash the transcoding process."}],"id":"CVE-2026-125194","lastModified":"2026-11-10T21:46:26.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125194","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:01:40.293131Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:55.370","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25694"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcm-dvdenc.c#L120"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/cfe6a6cd7de59341a70ebe6a2d477f3281aec834"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-pcm-dvd-encoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm_dvd_encode_frame() in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wrap and crash the transcoding process."}],"id":"CVE-2026-125194","lastModified":"2026-11-10T21:46:26.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125194","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:01:40.293131Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:55.370","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25694"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcm-dvdenc.c#L120"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/cfe6a6cd7de59341a70ebe6a2d477f3281aec834"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-pcm-dvd-encoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125195.json b/data/2026/CVE-2026-125195.json index 63c2b22a87..898ecde449 100644 --- a/data/2026/CVE-2026-125195.json +++ b/data/2026/CVE-2026-125195.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process."}],"id":"CVE-2026-125195","lastModified":"2026-11-10T21:46:37.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125195","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:14.395916Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:55.523","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25694"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/adpcmenc.c#L785"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/fb13409aaffc151f602ad357db46052e98ea46e8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-adpcm-ms-trellis-encoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this encoding receive output packets where about half of each block contains stale heap memory from the encoding process."}],"id":"CVE-2026-125195","lastModified":"2026-11-10T21:46:37.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125195","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:14.395916Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:55.523","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25694"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/adpcmenc.c#L785"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/fb13409aaffc151f602ad357db46052e98ea46e8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-adpcm-ms-trellis-encoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125196.json b/data/2026/CVE-2026-125196.json index 728f55358b..f2bb692d23 100644 --- a/data/2026/CVE-2026-125196.json +++ b/data/2026/CVE-2026-125196.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"8.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes mid-stream so that transcoding to APV without rescaling writes attacker-controlled pixel data past the imgb plane buffers."}],"id":"CVE-2026-125196","lastModified":"2026-11-10T21:46:33.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125196","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:59:49.358794Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:55.673","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/liboapvenc.c#L578"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/87cdb6cd6a8d1ec201cb82b30e64d5f946939e23"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-liboapv-apv-encoder-wrapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"8.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes mid-stream so that transcoding to APV without rescaling writes attacker-controlled pixel data past the imgb plane buffers."}],"id":"CVE-2026-125196","lastModified":"2026-11-10T21:46:33.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125196","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:59:49.358794Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:55.673","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25416"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/liboapvenc.c#L578"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/87cdb6cd6a8d1ec201cb82b30e64d5f946939e23"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-liboapv-apv-encoder-wrapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125197.json b/data/2026/CVE-2026-125197.json index e78e07b87a..7067ca4680 100644 --- a/data/2026/CVE-2026-125197.json +++ b/data/2026/CVE-2026-125197.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAG_MULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL video stream whose packet is shorter than 8 bytes, bypassing length clamping to crash the decoding application."}],"id":"CVE-2026-125197","lastModified":"2026-11-10T21:46:42.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:55.823","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25020"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/lcldec.c#L287"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/12e5d4ec98b7add7bcac9d8131d9a6dfb2549966"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-out-of-bounds-read-via-lcl-zlib-multithread-decoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAG_MULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL video stream whose packet is shorter than 8 bytes, bypassing length clamping to crash the decoding application."}],"id":"CVE-2026-125197","lastModified":"2026-11-10T21:46:42.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:55.823","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25020"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/lcldec.c#L287"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/12e5d4ec98b7add7bcac9d8131d9a6dfb2549966"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-out-of-bounds-read-via-lcl-zlib-multithread-decoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125198.json b/data/2026/CVE-2026-125198.json index 64316bb90b..5a92458c20 100644 --- a/data/2026/CVE-2026-125198.json +++ b/data/2026/CVE-2026-125198.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion."}],"id":"CVE-2026-125198","lastModified":"2026-11-10T21:46:30.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:55.977","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22550"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mediacodec_wrapper.c#L1134"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/e5d295b3cd467fc713300e208ba2dacc7ff603a0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-mediacodec-jni-setbuffer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion."}],"id":"CVE-2026-125198","lastModified":"2026-11-10T21:46:30.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:55.977","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22550"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mediacodec_wrapper.c#L1134"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/e5d295b3cd467fc713300e208ba2dacc7ff603a0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-mediacodec-jni-setbuffer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125199.json b/data/2026/CVE-2026-125199.json index d19ac8e9d4..5695c97764 100644 --- a/data/2026/CVE-2026-125199.json +++ b/data/2026/CVE-2026-125199.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"8.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1_decode_frame() in libavcodec/vc1dec.c that leaks slice buffers when init_get_bits8() fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit to exhaust memory of decoding applications."}],"id":"CVE-2026-125199","lastModified":"2026-11-10T21:46:26.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125199","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:01:24.435593Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:56.123","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vc1dec.c#L896"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/afdc555aace698b88c86d3f33a7773a6c8ba2897"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-in-vc-1-decoder-via-vc1-decode-frame"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"8.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1_decode_frame() in libavcodec/vc1dec.c that leaks slice buffers when init_get_bits8() fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit to exhaust memory of decoding applications."}],"id":"CVE-2026-125199","lastModified":"2026-11-10T21:46:26.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125199","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:01:24.435593Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:56.123","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vc1dec.c#L896"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/afdc555aace698b88c86d3f33a7773a6c8ba2897"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-in-vc-1-decoder-via-vc1-decode-frame"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125271.json b/data/2026/CVE-2026-125271.json index a1152cf6b1..914593a951 100644 --- a/data/2026/CVE-2026-125271.json +++ b/data/2026/CVE-2026-125271.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"aws-api-mcp-server","vendor":"AWS","versions":[{"lessThan":"1.5.1","status":"affected","version":"0.2.13","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls to operations whose names contain consecutive capital letters.\n\n\n\nTo remediate this issue, users should upgrade to version 1.5.1."}],"id":"CVE-2026-125271","lastModified":"2026-11-10T17:17:28.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-10T17:17:28.497","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-176-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/awslabs/mcp/security/advisories/GHSA-4wq9-grf3-qg2p"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://pypi.org/project/awslabs.aws-api-mcp-server/1.5.1/"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"},{"lang":"en","value":"CWE-1025"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"aws-api-mcp-server","vendor":"AWS","versions":[{"lessThan":"1.5.1","status":"affected","version":"0.2.13","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls to operations whose names contain consecutive capital letters.\n\n\n\nTo remediate this issue, users should upgrade to version 1.5.1."}],"id":"CVE-2026-125271","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-10T17:17:28.497","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-176-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/awslabs/mcp/security/advisories/GHSA-4wq9-grf3-qg2p"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://pypi.org/project/awslabs.aws-api-mcp-server/1.5.1/"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"},{"lang":"en","value":"CWE-1025"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125297.json b/data/2026/CVE-2026-125297.json index 2fd1b98da2..e813a870f3 100644 --- a/data/2026/CVE-2026-125297.json +++ b/data/2026/CVE-2026-125297.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Business Support System","vendor":"AsiaInfo International","versions":[{"lessThan":"9.2.41","status":"affected","version":"9.2.0","versionType":"custom"},{"status":"unaffected","version":"9.2.41"}]},{"defaultStatus":"unknown","product":"aether-menu","vendor":"AsiaInfo International","versions":[{"lessThan":"2.2.7","status":"affected","version":"2.2.1","versionType":"custom"},{"status":"unaffected","version":"2.2.7"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41."}],"id":"CVE-2026-125297","lastModified":"2026-11-10T22:18:30.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-125297","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:00:42.005682Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:30.080","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-125297.md"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-03.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.asiainfo.eu/cloudbss"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-125297"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-862"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Business Support System","vendor":"AsiaInfo International","versions":[{"lessThan":"9.2.41","status":"affected","version":"9.2.0","versionType":"custom"},{"status":"unaffected","version":"9.2.41"}]},{"defaultStatus":"unknown","product":"aether-menu","vendor":"AsiaInfo International","versions":[{"lessThan":"2.2.7","status":"affected","version":"2.2.1","versionType":"custom"},{"status":"unaffected","version":"2.2.7"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41."}],"id":"CVE-2026-125297","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-125297","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:00:42.005682Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:30.080","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-125297.md"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-03.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.asiainfo.eu/cloudbss"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-125297"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-862"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125298.json b/data/2026/CVE-2026-125298.json index 9ec666ad77..a2be8add95 100644 --- a/data/2026/CVE-2026-125298.json +++ b/data/2026/CVE-2026-125298.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Business Support System","vendor":"AsiaInfo International","versions":[{"lessThan":"9.2.41","status":"affected","version":"9.2.0","versionType":"custom"},{"status":"unaffected","version":"9.2.41"}]},{"defaultStatus":"unknown","product":"aether-menu","vendor":"AsiaInfo International","versions":[{"lessThan":"2.2.7","status":"affected","version":"2.2.1","versionType":"custom"},{"status":"unaffected","version":"2.2.7"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41."}],"id":"CVE-2026-125298","lastModified":"2026-11-10T22:18:30.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-125298","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:21:49.590365Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:30.240","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-125298.md"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-03.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.asiainfo.eu/cloudbss"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-125298"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Business Support System","vendor":"AsiaInfo International","versions":[{"lessThan":"9.2.41","status":"affected","version":"9.2.0","versionType":"custom"},{"status":"unaffected","version":"9.2.41"}]},{"defaultStatus":"unknown","product":"aether-menu","vendor":"AsiaInfo International","versions":[{"lessThan":"2.2.7","status":"affected","version":"2.2.1","versionType":"custom"},{"status":"unaffected","version":"2.2.7"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41."}],"id":"CVE-2026-125298","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-125298","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:21:49.590365Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:30.240","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-125298.md"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-03.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.asiainfo.eu/cloudbss"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-125298"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125323.json b/data/2026/CVE-2026-125323.json index 5cea0255d8..688989fd26 100644 --- a/data/2026/CVE-2026-125323.json +++ b/data/2026/CVE-2026-125323.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"control-plane","vendor":"pgEdge","versions":[{"status":"affected","version":"< 0.11.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0."}],"id":"CVE-2026-125323","lastModified":"2026-11-10T18:17:33.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T18:17:33.703","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/control-plane/pull/470"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/control-plane/releases/tag/v0.11.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-1188"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"control-plane","vendor":"pgEdge","versions":[{"status":"affected","version":"< 0.11.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg_hba.conf files began with hard-coded trust entries for Unix-socket and loopback connections. Because PostgreSQL evaluates the file from top to bottom, those entries also preempted operator-supplied rules in the pg_hba_conf field. Under the systemd orchestrator, any unprivileged operating-system account on a database host could authenticate as any PostgreSQL role, including the superuser, without credentials and obtain full control of the host's databases. Under Docker Swarm, reaching the container-local socket or loopback interface required code execution inside the database container. Publishing the PostgreSQL port to the host did not expose these trust rules because host connections did not appear to originate from 127.0.0.1 or ::1. This issue is fixed in version 0.11.0."}],"id":"CVE-2026-125323","lastModified":"2026-11-12T19:16:53.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125323","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:30:56.164483Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:33.703","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/control-plane/blob/main/changes/v0.11.0.md"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/control-plane/commit/88659f7388fc6c86125e60475aa83810171145b7"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/control-plane/pull/470"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/control-plane/releases/tag/v0.11.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/control-plane/security/advisories/GHSA-vq9p-w6wv-cr25"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-1188"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125324.json b/data/2026/CVE-2026-125324.json new file mode 100644 index 0000000000..a0c06214c7 --- /dev/null +++ b/data/2026/CVE-2026-125324.json @@ -0,0 +1 @@ +{"cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE is a duplicate of another CVE."}],"id":"CVE-2026-125324","lastModified":"2026-11-12T18:17:23.100","metrics":{},"published":"2026-11-12T18:17:23.100","references":[],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Rejected"} diff --git a/data/2026/CVE-2026-125327.json b/data/2026/CVE-2026-125327.json index d0f37670a5..93aa999943 100644 --- a/data/2026/CVE-2026-125327.json +++ b/data/2026/CVE-2026-125327.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"pgedge-rag-server","vendor":"pgEdge","versions":[{"status":"affected","version":"< 2.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0."}],"id":"CVE-2026-125327","lastModified":"2026-11-10T19:21:09.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T19:21:09.977","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/pull/44"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-405"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"pgedge-rag-server","vendor":"pgEdge","versions":[{"status":"affected","version":"< 2.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 index on every request. Because HybridEnabled is set by default in internal/config/loader.go and the endpoint has no rate limit, inexpensive remote queries can impose database and CPU work proportional to corpus size and exhaust service resources. This issue is fixed in version 2.0.0."}],"id":"CVE-2026-125327","lastModified":"2026-11-12T19:16:53.973","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125327","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:53.452605Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:09.977","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/commit/a09d4872356b510c81f11591845445c33ff45a84"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/pull/44"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/releases/tag/v2.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-rag-server/security/advisories/GHSA-5qg5-rgp6-j5m5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-405"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125331.json b/data/2026/CVE-2026-125331.json index 3e542f38ec..367e06344a 100644 --- a/data/2026/CVE-2026-125331.json +++ b/data/2026/CVE-2026-125331.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"harnessrouter","vendor":"HarnessRouter","versions":[{"status":"affected","version":"< 0.31.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8."}],"id":"CVE-2026-125331","lastModified":"2026-11-10T19:21:10.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T19:21:10.630","references":[{"source":"security-advisories@github.com","url":"https://github.com/HarnessRouter/harnessrouter/commit/28609ec65ed671112d7e5418926bbd3cb3b25c00"},{"source":"security-advisories@github.com","url":"https://github.com/HarnessRouter/harnessrouter/pull/418"},{"source":"security-advisories@github.com","url":"https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.8"},{"source":"security-advisories@github.com","url":"https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-p6cq-54cg-8mpv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"harnessrouter","vendor":"HarnessRouter","versions":[{"status":"affected","version":"< 0.31.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8."}],"id":"CVE-2026-125331","lastModified":"2026-11-12T19:16:54.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125331","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:53:22.134138Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:10.630","references":[{"source":"security-advisories@github.com","url":"https://github.com/HarnessRouter/harnessrouter/commit/28609ec65ed671112d7e5418926bbd3cb3b25c00"},{"source":"security-advisories@github.com","url":"https://github.com/HarnessRouter/harnessrouter/pull/418"},{"source":"security-advisories@github.com","url":"https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.8"},{"source":"security-advisories@github.com","url":"https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-p6cq-54cg-8mpv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125335.json b/data/2026/CVE-2026-125335.json index cda33d94a9..3cf4206a96 100644 --- a/data/2026/CVE-2026-125335.json +++ b/data/2026/CVE-2026-125335.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"forge","vendor":"digitalbazaar","versions":[{"status":"affected","version":"< 1.4.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical encodings. With S = 0 and a small-order R value, an attacker who can choose the public key can produce signatures that verify for many messages, or all messages with the identity key, without a private key. This can defeat proof-of-possession, attribution, non-repudiation, or deduplication checks that rely on a signature being bound to the message. Keys produced by normal Ed25519 key generation are not small-order, so applications that verify only trusted or internally generated public keys are not affected. This issue is fixed in version 1.4.3."}],"id":"CVE-2026-125335","lastModified":"2026-11-10T21:46:31.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T19:21:11.250","references":[{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/commit/1b77e6f20082d7484479303d0252d5f427651295"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6889-vf6x-f3g5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"forge","vendor":"digitalbazaar","versions":[{"status":"affected","version":"< 1.4.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical encodings. With S = 0 and a small-order R value, an attacker who can choose the public key can produce signatures that verify for many messages, or all messages with the identity key, without a private key. This can defeat proof-of-possession, attribution, non-repudiation, or deduplication checks that rely on a signature being bound to the message. Keys produced by normal Ed25519 key generation are not small-order, so applications that verify only trusted or internally generated public keys are not affected. This issue is fixed in version 1.4.3."}],"id":"CVE-2026-125335","lastModified":"2026-11-12T19:16:54.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125335","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:15.409336Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:11.250","references":[{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/commit/1b77e6f20082d7484479303d0252d5f427651295"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-6889-vf6x-f3g5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125339.json b/data/2026/CVE-2026-125339.json index 5a84ab9786..3c72cab19b 100644 --- a/data/2026/CVE-2026-125339.json +++ b/data/2026/CVE-2026-125339.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"winter","vendor":"wintercms","versions":[{"status":"affected","version":">= 1.0.319, < 1.2.14"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\\Classes\\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14."}],"id":"CVE-2026-125339","lastModified":"2026-11-10T20:19:08.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T20:19:08.410","references":[{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/commit/353b23804dee2acf49fca996c72637040446824f"},{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/releases/tag/v1.2.14"},{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/security/advisories/GHSA-p2ch-c2c3-4xm5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"winter","vendor":"wintercms","versions":[{"status":"affected","version":">= 1.0.319, < 1.2.14"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\\Classes\\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14."}],"id":"CVE-2026-125339","lastModified":"2026-11-12T19:16:54.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125339","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:18.986835Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:08.410","references":[{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/commit/353b23804dee2acf49fca996c72637040446824f"},{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/releases/tag/v1.2.14"},{"source":"security-advisories@github.com","url":"https://github.com/wintercms/winter/security/advisories/GHSA-p2ch-c2c3-4xm5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125342.json b/data/2026/CVE-2026-125342.json index 2203984c9a..632295192f 100644 --- a/data/2026/CVE-2026-125342.json +++ b/data/2026/CVE-2026-125342.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"id":"CVE-2026-125342","lastModified":"2026-11-10T20:19:08.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125342","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:07:07.647808Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.167","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/566384898"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"6670B19D-D9FF-4276-B04E-F35E8F3BB029","versionEndExcluding":"157.0.8103.50","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"id":"CVE-2026-125342","lastModified":"2026-11-12T18:34:04.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125342","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:07:07.647808Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.167","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/566384898"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125343.json b/data/2026/CVE-2026-125343.json index 2b4c252b7a..7e069505bb 100644 --- a/data/2026/CVE-2026-125343.json +++ b/data/2026/CVE-2026-125343.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-125343","lastModified":"2026-11-11T05:19:36.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125343","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.303","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/561998123"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"6670B19D-D9FF-4276-B04E-F35E8F3BB029","versionEndExcluding":"157.0.8103.50","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-125343","lastModified":"2026-11-12T18:33:40.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125343","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.303","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/561998123"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125344.json b/data/2026/CVE-2026-125344.json index df5559954f..febfc35c50 100644 --- a/data/2026/CVE-2026-125344.json +++ b/data/2026/CVE-2026-125344.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-125344","lastModified":"2026-11-11T05:19:37.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125344","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.443","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/568893995"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"6670B19D-D9FF-4276-B04E-F35E8F3BB029","versionEndExcluding":"157.0.8103.50","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-125344","lastModified":"2026-11-12T18:33:27.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125344","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.443","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/568893995"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125345.json b/data/2026/CVE-2026-125345.json index 9350364442..5e7c6cd6fe 100644 --- a/data/2026/CVE-2026-125345.json +++ b/data/2026/CVE-2026-125345.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-125345","lastModified":"2026-11-10T21:19:22.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125345","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:20:39.743375Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.577","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/550525698"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"6670B19D-D9FF-4276-B04E-F35E8F3BB029","versionEndExcluding":"157.0.8103.50","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-125345","lastModified":"2026-11-12T18:33:12.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125345","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:20:39.743375Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.577","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/550525698"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125347.json b/data/2026/CVE-2026-125347.json index e39e9a898b..e40e2a3fb0 100644 --- a/data/2026/CVE-2026-125347.json +++ b/data/2026/CVE-2026-125347.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-125347","lastModified":"2026-11-11T05:19:37.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125347","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.843","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/561996724"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"6670B19D-D9FF-4276-B04E-F35E8F3BB029","versionEndExcluding":"157.0.8103.50","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-125347","lastModified":"2026-11-12T18:32:49.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125347","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.843","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/561996724"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125348.json b/data/2026/CVE-2026-125348.json index e3d1f65937..ced78f88d5 100644 --- a/data/2026/CVE-2026-125348.json +++ b/data/2026/CVE-2026-125348.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-125348","lastModified":"2026-11-11T05:19:37.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125348","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.980","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/563358700"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"6670B19D-D9FF-4276-B04E-F35E8F3BB029","versionEndExcluding":"157.0.8103.50","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-125348","lastModified":"2026-11-12T19:51:53.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125348","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:34.980","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/563358700"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125349.json b/data/2026/CVE-2026-125349.json index 67e163a523..d76b95f704 100644 --- a/data/2026/CVE-2026-125349.json +++ b/data/2026/CVE-2026-125349.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"id":"CVE-2026-125349","lastModified":"2026-11-10T20:19:09.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.4,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125349","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:07:30.364489Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:35.110","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/536663516"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.50","status":"affected","version":"157.0.8103.50","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"6670B19D-D9FF-4276-B04E-F35E8F3BB029","versionEndExcluding":"157.0.8103.50","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}],"id":"CVE-2026-125349","lastModified":"2026-11-12T19:51:41.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.4,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125349","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:07:30.364489Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:35.110","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/536663516"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125371.json b/data/2026/CVE-2026-125371.json index 6b46428584..a4b89496a1 100644 --- a/data/2026/CVE-2026-125371.json +++ b/data/2026/CVE-2026-125371.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"tinyproxy","vendor":"tinyproxy","versions":[{"lessThanOrEqual":"1.11.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3991ac8f98c6a9f05b3265018b812dbf2ca92c28","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs."}],"id":"CVE-2026-125371","lastModified":"2026-11-10T19:21:11.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:46.899685Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:09.420","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tinyproxy/tinyproxy"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinyproxy/tinyproxy/issues/627"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-187"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"tinyproxy","vendor":"tinyproxy","versions":[{"lessThanOrEqual":"1.11.3","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3991ac8f98c6a9f05b3265018b812dbf2ca92c28","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs."}],"id":"CVE-2026-125371","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:46.899685Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:09.420","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tinyproxy/tinyproxy"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinyproxy/tinyproxy/issues/627"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-187"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125383.json b/data/2026/CVE-2026-125383.json index a41f614510..f7dae6ac3e 100644 --- a/data/2026/CVE-2026-125383.json +++ b/data/2026/CVE-2026-125383.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Asp.Net-Core-Inventory-Order-Management-System","vendor":"go2ismail","versions":[{"lessThan":"10.20261109","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API."}],"id":"CVE-2026-125383","lastModified":"2026-11-10T00:17:11.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:11.510","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System"},{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/blob/v9.20250118/Presentation/ASPNET/appsettings.json#L38-L44"},{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/65609b5b88cb4f156e8164f33b8db8c63f5c125b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/ded7d8a9457c780dfd4f5ea74d7e72111fafaea6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/issues/48"},{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/releases/tag/v10.20261109"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/indotalent-whms-before-10.20261109-hard-coded-jwt-signing-key-authentication-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Asp.Net-Core-Inventory-Order-Management-System","vendor":"go2ismail","versions":[{"lessThan":"10.20261109","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API."}],"id":"CVE-2026-125383","lastModified":"2026-11-12T19:16:54.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125383","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:53:19.390308Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:11.510","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System"},{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/blob/v9.20250118/Presentation/ASPNET/appsettings.json#L38-L44"},{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/65609b5b88cb4f156e8164f33b8db8c63f5c125b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/ded7d8a9457c780dfd4f5ea74d7e72111fafaea6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/issues/48"},{"source":"disclosure@vulncheck.com","url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/releases/tag/v10.20261109"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/indotalent-whms-before-10.20261109-hard-coded-jwt-signing-key-authentication-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125403.json b/data/2026/CVE-2026-125403.json index 39b6f70b95..108b23f837 100644 --- a/data/2026/CVE-2026-125403.json +++ b/data/2026/CVE-2026-125403.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Ettercap/ettercap","product":"ettercap","repo":"https://github.com/Ettercap/ettercap","vendor":"Ettercap","versions":[{"lessThanOrEqual":"0.8.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root."}],"id":"CVE-2026-125403","lastModified":"2026-11-10T19:21:12.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:58.860392Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:14.860","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_sslwrap.c#L1294-L1322"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/pull/1330"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-hq2w-pg4m-6w63"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-out-of-bounds-read-via-sslw-remove-sts"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Ettercap/ettercap","product":"ettercap","repo":"https://github.com/Ettercap/ettercap","vendor":"Ettercap","versions":[{"lessThanOrEqual":"0.8.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root."}],"id":"CVE-2026-125403","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:58.860392Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:14.860","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_sslwrap.c#L1294-L1322"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/pull/1330"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-hq2w-pg4m-6w63"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-out-of-bounds-read-via-sslw-remove-sts"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125612.json b/data/2026/CVE-2026-125612.json index 4b38cf3d02..6780b79d7f 100644 --- a/data/2026/CVE-2026-125612.json +++ b/data/2026/CVE-2026-125612.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DIAEnergie","vendor":"Deltaww","versions":[{"lessThan":"1.11.01.032","status":"affected","version":"0","versionType":"custom"}]}],"source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.\n\nThis issue affects DIAEnergie: before 1.11.01.032."}],"id":"CVE-2026-125612","lastModified":"2026-11-10T20:19:09.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:34:00.402699Z","version":"2.0.3"}}]},"published":"2026-11-10T03:16:42.547","references":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00017_DIAEnergie%20SQL%20Injection%20Vulnerability_v1.0.pdf"}],"sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DIAEnergie","vendor":"Deltaww","versions":[{"lessThan":"1.11.01.032","status":"affected","version":"0","versionType":"custom"}]}],"source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.\n\nThis issue affects DIAEnergie: before 1.11.01.032."}],"id":"CVE-2026-125612","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:34:00.402699Z","version":"2.0.3"}}]},"published":"2026-11-10T03:16:42.547","references":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00017_DIAEnergie%20SQL%20Injection%20Vulnerability_v1.0.pdf"}],"sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125703.json b/data/2026/CVE-2026-125703.json index 72ad5f7744..86d83cecad 100644 --- a/data/2026/CVE-2026-125703.json +++ b/data/2026/CVE-2026-125703.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service."}],"id":"CVE-2026-125703","lastModified":"2026-11-10T23:17:20.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-10T11:16:43.417","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125703"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569129"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11585"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0029.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service."}],"id":"CVE-2026-125703","lastModified":"2026-11-12T18:17:23.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-10T11:16:43.417","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125703"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569129"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11585"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0029.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125704.json b/data/2026/CVE-2026-125704.json index eaed6c7687..b23548957b 100644 --- a/data/2026/CVE-2026-125704.json +++ b/data/2026/CVE-2026-125704.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.26.7-5.el10_3.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.16.1-3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.22.12-3.el9_9.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established."}],"id":"CVE-2026-125704","lastModified":"2026-11-12T06:17:14.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-10T11:16:43.580","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99090"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99129"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99228"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125704"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569128"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11583.patch"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0028.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.26.7-5.el10_3.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.16.1-3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.22.12-3.el9_9.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established."}],"id":"CVE-2026-125704","lastModified":"2026-11-12T19:16:54.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125704","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:46.566628Z","version":"2.0.3"}}]},"published":"2026-11-10T11:16:43.580","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99090"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99129"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99228"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125704"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569128"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11583.patch"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0028.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125706.json b/data/2026/CVE-2026-125706.json index e6d3f183d2..1b0920e4c0 100644 --- a/data/2026/CVE-2026-125706.json +++ b/data/2026/CVE-2026-125706.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service."}],"id":"CVE-2026-125706","lastModified":"2026-11-10T23:17:20.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-10T12:17:18.083","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125706"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569125"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11580.patch"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0024.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service."}],"id":"CVE-2026-125706","lastModified":"2026-11-12T18:17:23.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-10T12:17:18.083","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125706"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569125"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11580.patch"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0024.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125707.json b/data/2026/CVE-2026-125707.json index e3a231dfc0..14bfb00609 100644 --- a/data/2026/CVE-2026-125707.json +++ b/data/2026/CVE-2026-125707.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test."}],"id":"CVE-2026-125707","lastModified":"2026-11-10T23:17:20.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:19:28.603570Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:18.243","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125707"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569127"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0027.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test."}],"id":"CVE-2026-125707","lastModified":"2026-11-12T18:17:23.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secalert@redhat.com","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:19:28.603570Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:18.243","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125707"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569127"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0027.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125729.json b/data/2026/CVE-2026-125729.json index c49565a1c0..19e31f8658 100644 --- a/data/2026/CVE-2026-125729.json +++ b/data/2026/CVE-2026-125729.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Plack::Middleware::CSP"],"packageName":"Plack-Middleware-CSP","packageURL":"pkg:cpan/Plack-Middleware-CSP","programFiles":["lib/Plack/Middleware/CSP.pm"],"programRoutines":[{"name":"Plack::Middleware::CSP::call"}],"repo":"https://github.com/pangyre/Plack-Middleware-CSP/","versions":[{"lessThan":"0.03","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it.\n\nThe call method sets the policy in a response header named \"content-security-protocol\" instead of \"Content-Security-Policy\". Browsers ignore that header.\n\nAny cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block."}],"id":"CVE-2026-125729","lastModified":"2026-11-10T20:19:09.787","metrics":{},"published":"2026-11-10T18:17:35.360","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/pangyre/Plack-Middleware-CSP/issues/1"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/ASHLEY/Plack-Middleware-CSP-0.03/source/CHANGES"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/10/16"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-684"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Plack::Middleware::CSP"],"packageName":"Plack-Middleware-CSP","packageURL":"pkg:cpan/Plack-Middleware-CSP","programFiles":["lib/Plack/Middleware/CSP.pm"],"programRoutines":[{"name":"Plack::Middleware::CSP::call"}],"repo":"https://github.com/pangyre/Plack-Middleware-CSP/","versions":[{"lessThan":"0.03","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it.\n\nThe call method sets the policy in a response header named \"content-security-protocol\" instead of \"Content-Security-Policy\". Browsers ignore that header.\n\nAny cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block."}],"id":"CVE-2026-125729","lastModified":"2026-11-12T20:07:11.090","metrics":{},"published":"2026-11-10T18:17:35.360","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/pangyre/Plack-Middleware-CSP/issues/1"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/ASHLEY/Plack-Middleware-CSP-0.03/source/CHANGES"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/10/16"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-684"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125742.json b/data/2026/CVE-2026-125742.json index 72144fd574..d2f2114145 100644 --- a/data/2026/CVE-2026-125742.json +++ b/data/2026/CVE-2026-125742.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"7-Zip","repo":"https://github.com/ip7z/7zip","vendor":"7-Zip","versions":[{"lessThan":"26.06","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling arbitrary code execution."}],"id":"CVE-2026-125742","lastModified":"2026-11-10T12:17:19.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T12:17:18.893","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/ip7z/7zip/blob/26.05/CPP/7zip/Compress/LzxDecoder.cpp#L1496-L1513"},{"source":"disclosure@vulncheck.com","url":"https://github.com/ip7z/7zip/commit/d3296e39e1f1f92c7b41c0c3848e65640428d42d"},{"source":"disclosure@vulncheck.com","url":"https://github.com/ip7z/7zip/releases/tag/26.06"},{"source":"disclosure@vulncheck.com","url":"https://potion-brew.pages.dev/posts/7zip-cab-lzx-window-desync-rce/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/7-zip-before-26.06-heap-out-of-bounds-write-via-lzx-decoder-in-cab-extraction"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"7-Zip","repo":"https://github.com/ip7z/7zip","vendor":"7-Zip","versions":[{"lessThan":"26.06","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, where a stale _pos value bypasses bounds checks, enabling arbitrary code execution."}],"id":"CVE-2026-125742","lastModified":"2026-11-12T19:16:54.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125742","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:56:38.968813Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:18.893","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/ip7z/7zip/blob/26.05/CPP/7zip/Compress/LzxDecoder.cpp#L1496-L1513"},{"source":"disclosure@vulncheck.com","url":"https://github.com/ip7z/7zip/commit/d3296e39e1f1f92c7b41c0c3848e65640428d42d"},{"source":"disclosure@vulncheck.com","url":"https://github.com/ip7z/7zip/releases/tag/26.06"},{"source":"disclosure@vulncheck.com","url":"https://potion-brew.pages.dev/posts/7zip-cab-lzx-window-desync-rce/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/7-zip-before-26.06-heap-out-of-bounds-write-via-lzx-decoder-in-cab-extraction"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125744.json b/data/2026/CVE-2026-125744.json index 5fcb88abfd..9bfaaf99bc 100644 --- a/data/2026/CVE-2026-125744.json +++ b/data/2026/CVE-2026-125744.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"pretix","repo":"https://github.com/pretix/pretix","vendor":"pretix","versions":[{"lessThan":"2026.7.4","status":"affected","version":"0","versionType":"python"},{"lessThan":"2026.8.2","status":"affected","version":"2026.8.0","versionType":"python"},{"lessThan":"2026.9.1","status":"affected","version":"2026.9.0","versionType":"python"}]}],"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout."}],"id":"CVE-2026-125744","lastModified":"2026-11-10T13:18:22.890","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":1.2,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6","type":"Secondary"}]},"published":"2026-11-10T13:18:22.890","references":[{"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6","url":"https://pretix.eu/about/en/blog/20261110-release-2026-9-1-adyen/"}],"sourceIdentifier":"655498c3-6ec5-4f0b-aea6-853b334d05a6","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"pretix","repo":"https://github.com/pretix/pretix","vendor":"pretix","versions":[{"lessThan":"2026.7.4","status":"affected","version":"0","versionType":"python"},{"lessThan":"2026.8.2","status":"affected","version":"2026.8.0","versionType":"python"},{"lessThan":"2026.9.1","status":"affected","version":"2026.9.0","versionType":"python"}]}],"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout."}],"id":"CVE-2026-125744","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":1.2,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6","type":"Secondary"}]},"published":"2026-11-10T13:18:22.890","references":[{"source":"655498c3-6ec5-4f0b-aea6-853b334d05a6","url":"https://pretix.eu/about/en/blog/20261110-release-2026-9-1-adyen/"}],"sourceIdentifier":"655498c3-6ec5-4f0b-aea6-853b334d05a6","vulnStatus":"Awaiting Analysis"} diff --git a/data/2026/CVE-2026-125755.json b/data/2026/CVE-2026-125755.json index d453fe128e..e7e96e6089 100644 --- a/data/2026/CVE-2026-125755.json +++ b/data/2026/CVE-2026-125755.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/nodemailer","product":"nodemailer","vendor":"nodemailer","versions":[{"lessThan":"10.4.1","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity."}],"id":"CVE-2026-125755","lastModified":"2026-11-10T16:17:22.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T16:17:22.767","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/blob/3b5cf1eec32c81f287870c8a1c9c09640062cfd5/src/addressparser/index.ts#L330-L345"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/commit/c2b9c41bb81b2294ebadd294ad15ff035a17d0a5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.4.1-recipient-allow-list-bypass-via-addressparser"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/nodemailer","product":"nodemailer","vendor":"nodemailer","versions":[{"lessThan":"10.4.1","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity."}],"id":"CVE-2026-125755","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T16:17:22.767","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/blob/3b5cf1eec32c81f287870c8a1c9c09640062cfd5/src/addressparser/index.ts#L330-L345"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/commit/c2b9c41bb81b2294ebadd294ad15ff035a17d0a5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.4.1-recipient-allow-list-bypass-via-addressparser"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125786.json b/data/2026/CVE-2026-125786.json index 6b93603140..58d55a9a7c 100644 --- a/data/2026/CVE-2026-125786.json +++ b/data/2026/CVE-2026-125786.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"quiz-master-next","product":"Quiz And Survey Master","vendor":"ExpressTech","versions":[{"changes":[{"at":"11.3.1","status":"unaffected"}],"lessThanOrEqual":"11.3.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Code Injection.This issue affects Quiz And Survey Master: from n/a through 11.3.0."}],"id":"CVE-2026-125786","lastModified":"2026-11-12T01:17:11.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-12T01:17:11.150","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-content-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"audit@patchstack.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"quiz-master-next","product":"Quiz And Survey Master","vendor":"ExpressTech","versions":[{"changes":[{"at":"11.3.1","status":"unaffected"}],"lessThanOrEqual":"11.3.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Code Injection.This issue affects Quiz And Survey Master: from n/a through 11.3.0."}],"id":"CVE-2026-125786","lastModified":"2026-11-12T17:17:32.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125786","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:13:40.370892Z","version":"2.0.3"}}]},"published":"2026-11-12T01:17:11.150","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-content-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"audit@patchstack.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125787.json b/data/2026/CVE-2026-125787.json index 03556c9924..3ada7c6f7d 100644 --- a/data/2026/CVE-2026-125787.json +++ b/data/2026/CVE-2026-125787.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"quiz-master-next","product":"Quiz And Survey Master","vendor":"ExpressTech","versions":[{"changes":[{"at":"11.3.1","status":"unaffected"}],"lessThanOrEqual":"11.3.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0."}],"id":"CVE-2026-125787","lastModified":"2026-11-12T01:17:11.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-12T01:17:11.297","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"quiz-master-next","product":"Quiz And Survey Master","vendor":"ExpressTech","versions":[{"changes":[{"at":"11.3.1","status":"unaffected"}],"lessThanOrEqual":"11.3.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0."}],"id":"CVE-2026-125787","lastModified":"2026-11-12T18:17:23.727","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125787","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:35.000977Z","version":"2.0.3"}}]},"published":"2026-11-12T01:17:11.297","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12591.json b/data/2026/CVE-2026-12591.json index e46834ee16..4964a38b8c 100644 --- a/data/2026/CVE-2026-12591.json +++ b/data/2026/CVE-2026-12591.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"M365 Manager Plus","vendor":"Zohocorp","versions":[{"lessThan":"4818","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing."}],"id":"CVE-2026-12591","lastModified":"2026-11-12T07:16:47.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T07:16:47.260","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"M365 Manager Plus","vendor":"Zohocorp","versions":[{"lessThan":"4818","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing."}],"id":"CVE-2026-12591","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T07:16:47.260","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125926.json b/data/2026/CVE-2026-125926.json index a2879076d9..8a40e6d9a0 100644 --- a/data/2026/CVE-2026-125926.json +++ b/data/2026/CVE-2026-125926.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mcp-gateway-registry","vendor":"AWS","versions":[{"lessThanOrEqual":"1.34.0","status":"affected","version":"1.0.3","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.35.0."}],"id":"CVE-2026-125926","lastModified":"2026-11-11T21:16:42.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-11T21:16:42.867","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-180-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.35.0"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mcp-gateway-registry","vendor":"AWS","versions":[{"lessThanOrEqual":"1.34.0","status":"affected","version":"1.0.3","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.35.0."}],"id":"CVE-2026-125926","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-11T21:16:42.867","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-180-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.35.0"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126051.json b/data/2026/CVE-2026-126051.json index 59b2dbc404..48996cc24d 100644 --- a/data/2026/CVE-2026-126051.json +++ b/data/2026/CVE-2026-126051.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x."}],"id":"CVE-2026-126051","lastModified":"2026-11-11T19:17:36.600","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:36.600","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x."}],"id":"CVE-2026-126051","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]},"published":"2026-11-11T19:17:36.600","references":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://cna.openjsf.org/security-advisories.html"},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}],"sourceIdentifier":"ce714d77-add3-4f53-aff5-83d477b104bb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126062.json b/data/2026/CVE-2026-126062.json index 9323f7551e..8769c947cd 100644 --- a/data/2026/CVE-2026-126062.json +++ b/data/2026/CVE-2026-126062.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"nokogiri","vendor":"sparklemotion","versions":[{"status":"affected","version":"< 1.19.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5."}],"id":"CVE-2026-126062","lastModified":"2026-11-10T20:19:10.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T20:19:10.030","references":[{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"},{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"nokogiri","vendor":"sparklemotion","versions":[{"status":"affected","version":"< 1.19.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5."}],"id":"CVE-2026-126062","lastModified":"2026-11-12T19:16:54.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126062","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:21.600157Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:10.030","references":[{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/pull/3752"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"},{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126066.json b/data/2026/CVE-2026-126066.json index 008bfe269e..3d840d8ee3 100644 --- a/data/2026/CVE-2026-126066.json +++ b/data/2026/CVE-2026-126066.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"fast-xml-parser","vendor":"NaturalIntelligence","versions":[{"status":"affected","version":"< 5.12.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0."}],"id":"CVE-2026-126066","lastModified":"2026-11-10T21:19:24.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:24.487","references":[{"source":"security-advisories@github.com","url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4"},{"source":"security-advisories@github.com","url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0"},{"source":"security-advisories@github.com","url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"fast-xml-parser","vendor":"NaturalIntelligence","versions":[{"status":"affected","version":"< 5.12.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character in an unterminated stop-node body and repeatedly rescans the remaining input while looking for a closing greater-than character. An attacker who supplies XML containing many tag fragments without a later closing character can cause quadratic rescanning before parsing fails, blocking a Node.js event loop and causing CPU-exhaustion denial of service. This issue is fixed in version 5.12.0."}],"id":"CVE-2026-126066","lastModified":"2026-11-12T18:17:23.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126066","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:25.008210Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:24.487","references":[{"source":"security-advisories@github.com","url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/0c3659348364959da62954b73728fb3bd05ebcb4"},{"source":"security-advisories@github.com","url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.12.0"},{"source":"security-advisories@github.com","url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-474x-hrwr-fgx4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126070.json b/data/2026/CVE-2026-126070.json index f43732ad9c..23c35f0b55 100644 --- a/data/2026/CVE-2026-126070.json +++ b/data/2026/CVE-2026-126070.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":"< 8.0.5.2"},{"status":"affected","version":">= 8.1, < 8.1.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving \" and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126070","lastModified":"2026-11-10T21:19:25.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:25.117","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":"< 8.0.5.2"},{"status":"affected","version":">= 8.1, < 8.1.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving \" and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126070","lastModified":"2026-11-12T18:17:24.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126070","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:28.666629Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:25.117","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126073.json b/data/2026/CVE-2026-126073.json index 039a046f2b..1002e76f8a 100644 --- a/data/2026/CVE-2026-126073.json +++ b/data/2026/CVE-2026-126073.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Rendering#_set_vary_header adds Vary: Accept only when the request carries a usable Accept header and the response has no Vary header yet. A response to a request without Accept, or to an XHR request, therefore omits the headers that selected its representation, and a response whose Vary the application set before rendering (for example Vary: Accept-Language) never gains Accept. A shared cache that honours Vary could store such a response and serve it to later clients that request a different representation, possibly leading to cache poisoning in which visitors receive, until the entry expires, a page without its layout or HTML in place of JSON. The attacker cannot choose the content of the response. Applications that render negotiated responses from actions marked public (for example with expires_in ..., public: true) behind a shared cache that honours Vary, such as Thruster or Rack::Cache, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126073","lastModified":"2026-11-10T21:19:25.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:25.563","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Rendering#_set_vary_header adds Vary: Accept only when the request carries a usable Accept header and the response has no Vary header yet. A response to a request without Accept, or to an XHR request, therefore omits the headers that selected its representation, and a response whose Vary the application set before rendering (for example Vary: Accept-Language) never gains Accept. A shared cache that honours Vary could store such a response and serve it to later clients that request a different representation, possibly leading to cache poisoning in which visitors receive, until the entry expires, a page without its layout or HTML in place of JSON. The attacker cannot choose the content of the response. Applications that render negotiated responses from actions marked public (for example with expires_in ..., public: true) behind a shared cache that honours Vary, such as Thruster or Rack::Cache, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126073","lastModified":"2026-11-12T18:17:24.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:31.033828Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:25.563","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126075.json b/data/2026/CVE-2026-126075.json index 2a56fa53a5..942bd101a4 100644 --- a/data/2026/CVE-2026-126075.json +++ b/data/2026/CVE-2026-126075.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. From 8.1 until 8.1.4.1, ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer html_safe? (for example, one mutated in place with gsub!) is restored as html_safe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.action_dispatch.cookies_serializer = :message_pack or :message_pack_allow_marshal, or serializer: :message_pack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a SafeBuffer that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize SafeBuffer with MessagePack and are not affected. This issue is fixed in version 8.1.4.1."}],"id":"CVE-2026-126075","lastModified":"2026-11-10T21:19:25.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:25.880","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-2w9f-fxwj-w2qf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. From 8.1 until 8.1.4.1, ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer html_safe? (for example, one mutated in place with gsub!) is restored as html_safe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.action_dispatch.cookies_serializer = :message_pack or :message_pack_allow_marshal, or serializer: :message_pack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a SafeBuffer that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize SafeBuffer with MessagePack and are not affected. This issue is fixed in version 8.1.4.1."}],"id":"CVE-2026-126075","lastModified":"2026-11-12T19:16:55.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126075","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:04:03.818823Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:25.880","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-2w9f-fxwj-w2qf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126076.json b/data/2026/CVE-2026-126076.json index c045c4fbde..bb274f715d 100644 --- a/data/2026/CVE-2026-126076.json +++ b/data/2026/CVE-2026-126076.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through reset_session on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to end a session, and an attacker who holds a stolen session cookie could keep that session valid across the victim's logout. Applications that use config.session_store :cache_store are affected, with any cache backend. ActionDispatch::Session::CookieStore is not affected, nor is ActionDispatch::Session::MemCacheStore with Dalli 4.0.0 or later, whose session store does not write back a session that was deleted. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126076","lastModified":"2026-11-10T21:19:26.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:26.040","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through reset_session on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to end a session, and an attacker who holds a stolen session cookie could keep that session valid across the victim's logout. Applications that use config.session_store :cache_store are affected, with any cache backend. ActionDispatch::Session::CookieStore is not affected, nor is ActionDispatch::Session::MemCacheStore with Dalli 4.0.0 or later, whose session store does not write back a session that was deleted. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126076","lastModified":"2026-11-12T19:16:55.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126076","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:04:57.165186Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:26.040","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126078.json b/data/2026/CVE-2026-126078.json index a9f1ad4512..87e2ffd4a0 100644 --- a/data/2026/CVE-2026-126078.json +++ b/data/2026/CVE-2026-126078.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":"< 8.0.5.2"},{"status":"affected","version":">= 8.1, < 8.1.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a :highlighter that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default \\1 highlighter and the block form are not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126078","lastModified":"2026-11-10T21:19:26.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:26.350","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":"< 8.0.5.2"},{"status":"affected","version":">= 8.1, < 8.1.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a :highlighter that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default \\1 highlighter and the block form are not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126078","lastModified":"2026-11-12T18:17:24.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:33.272888Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:26.350","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126080.json b/data/2026/CVE-2026-126080.json index c70fa9577e..29bead4d86 100644 --- a/data/2026/CVE-2026-126080.json +++ b/data/2026/CVE-2026-126080.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. Prior to 8.1.4.1 and 8.0.5.2, when constant lookup raises LoadError, ActiveSupport::Inflector#safe_constantize (and String#safe_constantize) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable. Action Cable passes the channel value of each subscribe command to safe_constantize before any channel lookup, so an unauthenticated client can reach this code when the application mounts Action Cable and accepts connections from untrusted clients without an added authentication check. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126080","lastModified":"2026-11-10T21:19:26.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:26.663","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. Prior to 8.1.4.1 and 8.0.5.2, when constant lookup raises LoadError, ActiveSupport::Inflector#safe_constantize (and String#safe_constantize) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable. Action Cable passes the channel value of each subscribe command to safe_constantize before any channel lookup, so an unauthenticated client can reach this code when the application mounts Action Cable and accepts connections from untrusted clients without an added authentication check. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126080","lastModified":"2026-11-12T19:16:55.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126080","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:08:45.685836Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:26.663","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126082.json b/data/2026/CVE-2026-126082.json index 1edf1be4a0..2e5ee556a8 100644 --- a/data/2026/CVE-2026-126082.json +++ b/data/2026/CVE-2026-126082.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, a Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include secret_key_base and credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems. ImageMagick selects a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of ImageMagick's coders, and the ImageMagick analyzer runs when a file is attached, so an attacker who can upload a crafted file may be able to invoke one. Attaching the upload is sufficient; no variant, preview, or analyze call is required. One specific attack chain has been reported, but other attack chains may exist. An application is affected when it uses ImageMagick for Active Storage image processing through config.active_storage.variant_processor = :mini_magick, runs ImageMagick under a security policy that does not already deny the involved coders, and allows uploads from untrusted users. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126082","lastModified":"2026-11-10T21:19:26.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:26.980","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/ea8c40121ce53a3d0255cd4eb6d13bfe3bc01776"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1188"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE is a duplicate of another CVE."}],"id":"CVE-2026-126082","lastModified":"2026-11-12T17:17:32.170","metrics":{},"published":"2026-11-10T21:19:26.980","references":[],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Rejected"} diff --git a/data/2026/CVE-2026-126084.json b/data/2026/CVE-2026-126084.json index be28c874e2..ac28603403 100644 --- a/data/2026/CVE-2026-126084.json +++ b/data/2026/CVE-2026-126084.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, when a GCS service is configured with the cache_control option, ActiveStorage::Service::GCSService#url_for_direct_upload signs direct-upload URLs with V4, and the V4 signature covers only the Cache-Control and Host headers. A direct-upload client can therefore send a Content-Type of its choosing, and can omit the declared Content-MD5, without invalidating the URL. GCS stores the supplied content type as object metadata, which takes precedence over the response-content-type that Active Storage sets on download URLs, so an uploaded object could be served as inline HTML under the application's bucket path on storage.googleapis.com. Script in such an object runs on the storage origin rather than the application's, but could register a Service Worker scoped to the bucket path and read or replace a victim's later responses for signed URLs in that bucket. Applications that use the GCS service with cache_control configured and accept direct uploads are affected. GCS services without cache_control sign with V2 and are not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126084","lastModified":"2026-11-10T21:19:27.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:27.287","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-3w93-6hmw-whh4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, when a GCS service is configured with the cache_control option, ActiveStorage::Service::GCSService#url_for_direct_upload signs direct-upload URLs with V4, and the V4 signature covers only the Cache-Control and Host headers. A direct-upload client can therefore send a Content-Type of its choosing, and can omit the declared Content-MD5, without invalidating the URL. GCS stores the supplied content type as object metadata, which takes precedence over the response-content-type that Active Storage sets on download URLs, so an uploaded object could be served as inline HTML under the application's bucket path on storage.googleapis.com. Script in such an object runs on the storage origin rather than the application's, but could register a Service Worker scoped to the bucket path and read or replace a victim's later responses for signed URLs in that bucket. Applications that use the GCS service with cache_control configured and accept direct uploads are affected. GCS services without cache_control sign with V2 and are not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126084","lastModified":"2026-11-12T19:16:55.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:10:19.483535Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:27.287","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-3w93-6hmw-whh4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126087.json b/data/2026/CVE-2026-126087.json index a14ccd3b04..2086ca40e7 100644 --- a/data/2026/CVE-2026-126087.json +++ b/data/2026/CVE-2026-126087.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openjd-sessions","vendor":"AWS","versions":[{"lessThan":"0.11.0","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"deadline-cloud-worker-agent","vendor":"AWS","versions":[{"lessThan":"0.33.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary code as the worker agent OS user and obtain the AWS credentials held by the worker agent via a crafted job that modifies the PATH environment variable.\n\n\n\nTo remediate this issue, users of customer-managed fleets should upgrade the Deadline Cloud worker agent to version 0.33.0 or later, which includes OpenJD Sessions 0.11.0. Service-managed fleets were remediated service-side."}],"id":"CVE-2026-126087","lastModified":"2026-11-10T19:21:13.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-10T19:21:13.740","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-177-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/OpenJobDescription/openjd-sessions-for-python/releases/tag/0.11.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws-deadline/deadline-cloud-worker-agent/releases/tag/0.33.0"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-426"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openjd-sessions","vendor":"AWS","versions":[{"lessThan":"0.11.0","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"deadline-cloud-worker-agent","vendor":"AWS","versions":[{"lessThan":"0.33.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue to execute arbitrary code as the worker agent OS user and obtain the AWS credentials held by the worker agent via a crafted job that modifies the PATH environment variable.\n\n\n\nTo remediate this issue, users of customer-managed fleets should upgrade the Deadline Cloud worker agent to version 0.33.0 or later, which includes OpenJD Sessions 0.11.0. Service-managed fleets were remediated service-side."}],"id":"CVE-2026-126087","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-10T19:21:13.740","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-177-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/OpenJobDescription/openjd-sessions-for-python/releases/tag/0.11.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws-deadline/deadline-cloud-worker-agent/releases/tag/0.33.0"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-426"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126123.json b/data/2026/CVE-2026-126123.json index 333a58ca9f..282debc4b4 100644 --- a/data/2026/CVE-2026-126123.json +++ b/data/2026/CVE-2026-126123.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"ERP","vendor":"BeeS Software Solutions","versions":[{"lessThan":"2026-09-04","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026-09-04"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data."}],"id":"CVE-2026-126123","lastModified":"2026-11-10T22:18:31.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-126123","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-21T15:12:17.423908Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:31.577","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-04.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-126123"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"ERP","vendor":"BeeS Software Solutions","versions":[{"lessThan":"2026-09-04","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026-09-04"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data."}],"id":"CVE-2026-126123","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-126123","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-21T15:12:17.423908Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:31.577","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-04.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-126123"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126144.json b/data/2026/CVE-2026-126144.json index ef7c5a6850..2867317e2a 100644 --- a/data/2026/CVE-2026-126144.json +++ b/data/2026/CVE-2026-126144.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortirecorder:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiRecorder","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortivoice:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiVoice","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.4.2","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.5","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.8","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder 7.6.0 through 7.6.2, FortiRecorder 7.2.0 through 7.2.12, FortiRecorder 7.0.0 through 7.0.6, FortiVoice 8.0.0 through 8.0.1, FortiVoice 7.4.0 through 7.4.2, FortiVoice 7.2.0 through 7.2.5, FortiVoice 7.0.0 through 7.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}],"id":"CVE-2026-126144","lastModified":"2026-11-11T22:17:11.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.400","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-196"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortirecorder:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiRecorder","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortivoice:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiVoice","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.4.2","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.5","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.8","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder 7.6.0 through 7.6.2, FortiRecorder 7.2.0 through 7.2.12, FortiRecorder 7.0.0 through 7.0.6, FortiVoice 8.0.0 through 8.0.1, FortiVoice 7.4.0 through 7.4.2, FortiVoice 7.2.0 through 7.2.5, FortiVoice 7.0.0 through 7.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}],"id":"CVE-2026-126144","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.400","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-196"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126145.json b/data/2026/CVE-2026-126145.json index caed25803a..1de2c44b9c 100644 --- a/data/2026/CVE-2026-126145.json +++ b/data/2026/CVE-2026-126145.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root."}],"id":"CVE-2026-126145","lastModified":"2026-11-11T22:17:11.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.580","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-197"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root."}],"id":"CVE-2026-126145","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.580","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-197"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126146.json b/data/2026/CVE-2026-126146.json index 404112fb41..c4056b383a 100644 --- a/data/2026/CVE-2026-126146.json +++ b/data/2026/CVE-2026-126146.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiRecorder","vendor":"Fortinet","versions":[{"status":"affected","version":"7.6.0"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6.0, FortiRecorder 7.2.0 through 7.2.11, FortiRecorder 7.0.0 through 7.0.6 may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration."}],"id":"CVE-2026-126146","lastModified":"2026-11-11T22:17:11.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.720","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiRecorder","vendor":"Fortinet","versions":[{"status":"affected","version":"7.6.0"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6.0, FortiRecorder 7.2.0 through 7.2.11, FortiRecorder 7.0.0 through 7.0.6 may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration."}],"id":"CVE-2026-126146","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.720","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126147.json b/data/2026/CVE-2026-126147.json index 6dec2d82b9..a3fa0b360c 100644 --- a/data/2026/CVE-2026-126147.json +++ b/data/2026/CVE-2026-126147.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126147","lastModified":"2026-11-11T22:17:11.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.880","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-199"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126147","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.880","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-199"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126148.json b/data/2026/CVE-2026-126148.json index 56169a6241..6ece97a810 100644 --- a/data/2026/CVE-2026-126148.json +++ b/data/2026/CVE-2026-126148.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets."}],"id":"CVE-2026-126148","lastModified":"2026-11-11T22:17:12.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.010","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-200"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets."}],"id":"CVE-2026-126148","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.010","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-200"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126149.json b/data/2026/CVE-2026-126149.json index 1d7e9cfa54..cca79aaabf 100644 --- a/data/2026/CVE-2026-126149.json +++ b/data/2026/CVE-2026-126149.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon."}],"id":"CVE-2026-126149","lastModified":"2026-11-11T22:17:12.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.137","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-201"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon."}],"id":"CVE-2026-126149","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.137","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-201"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126150.json b/data/2026/CVE-2026-126150.json index 2755cc8936..452e86e89a 100644 --- a/data/2026/CVE-2026-126150.json +++ b/data/2026/CVE-2026-126150.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.5","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests."}],"id":"CVE-2026-126150","lastModified":"2026-11-11T22:17:12.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.543","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-202"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.5","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests."}],"id":"CVE-2026-126150","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.543","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-202"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126151.json b/data/2026/CVE-2026-126151.json index 7b5fb38978..e7bb1698e1 100644 --- a/data/2026/CVE-2026-126151.json +++ b/data/2026/CVE-2026-126151.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request."}],"id":"CVE-2026-126151","lastModified":"2026-11-11T22:17:12.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.720","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-303"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request."}],"id":"CVE-2026-126151","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.720","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-303"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126152.json b/data/2026/CVE-2026-126152.json index e014971d4a..b8e5878dc3 100644 --- a/data/2026/CVE-2026-126152.json +++ b/data/2026/CVE-2026-126152.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces."}],"id":"CVE-2026-126152","lastModified":"2026-11-11T22:17:12.877","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.877","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-204"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces."}],"id":"CVE-2026-126152","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.877","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-204"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126153.json b/data/2026/CVE-2026-126153.json index 56e50194f7..689e7c11ac 100644 --- a/data/2026/CVE-2026-126153.json +++ b/data/2026/CVE-2026-126153.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized commands via crafted requests."}],"id":"CVE-2026-126153","lastModified":"2026-11-11T22:17:13.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.050","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized commands via crafted requests."}],"id":"CVE-2026-126153","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.050","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126154.json b/data/2026/CVE-2026-126154.json index b0020a0c79..a2f2b0e003 100644 --- a/data/2026/CVE-2026-126154.json +++ b/data/2026/CVE-2026-126154.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted HTTP request."}],"id":"CVE-2026-126154","lastModified":"2026-11-11T22:17:13.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.190","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-206"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted HTTP request."}],"id":"CVE-2026-126154","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.190","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-206"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126155.json b/data/2026/CVE-2026-126155.json index 5b61e308e2..c2c7ab6460 100644 --- a/data/2026/CVE-2026-126155.json +++ b/data/2026/CVE-2026-126155.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests."}],"id":"CVE-2026-126155","lastModified":"2026-11-11T22:17:13.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.323","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-207"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests."}],"id":"CVE-2026-126155","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.323","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-207"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126156.json b/data/2026/CVE-2026-126156.json index 17dadf7d95..610f5677d2 100644 --- a/data/2026/CVE-2026-126156.json +++ b/data/2026/CVE-2026-126156.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests."}],"id":"CVE-2026-126156","lastModified":"2026-11-11T22:17:13.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.450","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-208"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests."}],"id":"CVE-2026-126156","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.450","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-208"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126157.json b/data/2026/CVE-2026-126157.json index bf82dbc826..390a33b3d7 100644 --- a/data/2026/CVE-2026-126157.json +++ b/data/2026/CVE-2026-126157.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests."}],"id":"CVE-2026-126157","lastModified":"2026-11-11T22:17:13.587","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.587","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-209"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests."}],"id":"CVE-2026-126157","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.587","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-209"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126158.json b/data/2026/CVE-2026-126158.json index cef9a7de20..a1d8f07e52 100644 --- a/data/2026/CVE-2026-126158.json +++ b/data/2026/CVE-2026-126158.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests."}],"id":"CVE-2026-126158","lastModified":"2026-11-11T22:17:13.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.723","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-210"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests."}],"id":"CVE-2026-126158","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.723","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-210"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126159.json b/data/2026/CVE-2026-126159.json index f035061251..0eb1afa9d9 100644 --- a/data/2026/CVE-2026-126159.json +++ b/data/2026/CVE-2026-126159.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release request."}],"id":"CVE-2026-126159","lastModified":"2026-11-11T22:17:13.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.857","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-211"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release request."}],"id":"CVE-2026-126159","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.857","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-211"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126160.json b/data/2026/CVE-2026-126160.json index 3a8c7d4527..4216fb649f 100644 --- a/data/2026/CVE-2026-126160.json +++ b/data/2026/CVE-2026-126160.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests."}],"id":"CVE-2026-126160","lastModified":"2026-11-11T22:17:13.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.990","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-212"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests."}],"id":"CVE-2026-126160","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.990","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-212"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126161.json b/data/2026/CVE-2026-126161.json index af453996dc..7761592ffa 100644 --- a/data/2026/CVE-2026-126161.json +++ b/data/2026/CVE-2026-126161.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests."}],"id":"CVE-2026-126161","lastModified":"2026-11-11T22:17:14.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.123","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-213"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests."}],"id":"CVE-2026-126161","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.123","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-213"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126162.json b/data/2026/CVE-2026-126162.json index ba76fd4785..a41714872d 100644 --- a/data/2026/CVE-2026-126162.json +++ b/data/2026/CVE-2026-126162.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126162","lastModified":"2026-11-11T22:17:14.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.270","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-214"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126162","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.270","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-214"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126163.json b/data/2026/CVE-2026-126163.json index 6acbcc54de..b07ecd1c2c 100644 --- a/data/2026/CVE-2026-126163.json +++ b/data/2026/CVE-2026-126163.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command."}],"id":"CVE-2026-126163","lastModified":"2026-11-11T22:17:14.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.403","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command."}],"id":"CVE-2026-126163","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.403","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126164.json b/data/2026/CVE-2026-126164.json index 92eff0d0dc..e318a8c061 100644 --- a/data/2026/CVE-2026-126164.json +++ b/data/2026/CVE-2026-126164.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126164","lastModified":"2026-11-11T22:17:14.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.537","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-216"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126164","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.537","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-216"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126165.json b/data/2026/CVE-2026-126165.json index c615fbc4d7..399031ed4b 100644 --- a/data/2026/CVE-2026-126165.json +++ b/data/2026/CVE-2026-126165.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted attachment delivered over SMTP."}],"id":"CVE-2026-126165","lastModified":"2026-11-11T22:17:14.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.673","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-217"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted attachment delivered over SMTP."}],"id":"CVE-2026-126165","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.673","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-217"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126166.json b/data/2026/CVE-2026-126166.json index e4bf942b52..759cc0299e 100644 --- a/data/2026/CVE-2026-126166.json +++ b/data/2026/CVE-2026-126166.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126166","lastModified":"2026-11-11T22:17:14.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.803","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126166","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.803","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126167.json b/data/2026/CVE-2026-126167.json index eb87364de1..4caed3fe69 100644 --- a/data/2026/CVE-2026-126167.json +++ b/data/2026/CVE-2026-126167.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126167","lastModified":"2026-11-11T22:17:14.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.940","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126167","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.940","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126168.json b/data/2026/CVE-2026-126168.json index 2c8cc3d948..0022f42e6d 100644 --- a/data/2026/CVE-2026-126168.json +++ b/data/2026/CVE-2026-126168.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126168","lastModified":"2026-11-11T22:17:15.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.067","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126168","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.067","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126169.json b/data/2026/CVE-2026-126169.json index e86bd4a4c7..5c563978c7 100644 --- a/data/2026/CVE-2026-126169.json +++ b/data/2026/CVE-2026-126169.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126169","lastModified":"2026-11-11T22:17:15.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.200","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126169","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.200","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126170.json b/data/2026/CVE-2026-126170.json index f6eb60f793..42b3dcfcc4 100644 --- a/data/2026/CVE-2026-126170.json +++ b/data/2026/CVE-2026-126170.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.1","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.1","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer-BigData","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request"}],"id":"CVE-2026-126170","lastModified":"2026-11-11T22:17:15.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.340","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.1","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.1","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer-BigData","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request"}],"id":"CVE-2026-126170","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.340","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126171.json b/data/2026/CVE-2026-126171.json index 6ce5aa89df..e3f55a372a 100644 --- a/data/2026/CVE-2026-126171.json +++ b/data/2026/CVE-2026-126171.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP request"}],"id":"CVE-2026-126171","lastModified":"2026-11-11T22:17:15.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.500","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP request"}],"id":"CVE-2026-126171","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.500","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126175.json b/data/2026/CVE-2026-126175.json index d237fcd2e2..8d4d673536 100644 --- a/data/2026/CVE-2026-126175.json +++ b/data/2026/CVE-2026-126175.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.2","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.2 through 7.2.12, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.2 through 7.2.13, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.2 through 7.2.12, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.2 through 7.2.13 may allow an authenticated attacker to execute unauthorized code or commands via crafted JSON-RPC requests."}],"id":"CVE-2026-126175","lastModified":"2026-11-11T22:17:15.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.747","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.2","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.2 through 7.2.12, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.2 through 7.2.13, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.2 through 7.2.12, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.2 through 7.2.13 may allow an authenticated attacker to execute unauthorized code or commands via crafted JSON-RPC requests."}],"id":"CVE-2026-126175","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.747","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126176.json b/data/2026/CVE-2026-126176.json index 54f0445c9c..a8cad63c55 100644 --- a/data/2026/CVE-2026-126176.json +++ b/data/2026/CVE-2026-126176.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests."}],"id":"CVE-2026-126176","lastModified":"2026-11-11T22:17:15.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.950","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests."}],"id":"CVE-2026-126176","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.950","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126177.json b/data/2026/CVE-2026-126177.json index b95f101f7e..9f7984e06a 100644 --- a/data/2026/CVE-2026-126177.json +++ b/data/2026/CVE-2026-126177.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests."}],"id":"CVE-2026-126177","lastModified":"2026-11-11T22:17:16.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.157","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests."}],"id":"CVE-2026-126177","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.157","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126178.json b/data/2026/CVE-2026-126178.json index 4903787a2d..1bbb925fd4 100644 --- a/data/2026/CVE-2026-126178.json +++ b/data/2026/CVE-2026-126178.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via a crafted request."}],"id":"CVE-2026-126178","lastModified":"2026-11-11T22:17:16.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.370","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-223"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via a crafted request."}],"id":"CVE-2026-126178","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.370","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-223"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126179.json b/data/2026/CVE-2026-126179.json index fddc252597..fd21682788 100644 --- a/data/2026/CVE-2026-126179.json +++ b/data/2026/CVE-2026-126179.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests"}],"id":"CVE-2026-126179","lastModified":"2026-11-11T22:17:16.587","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.587","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests"}],"id":"CVE-2026-126179","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.587","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126180.json b/data/2026/CVE-2026-126180.json index 33aa25da85..0f9a9f0ca8 100644 --- a/data/2026/CVE-2026-126180.json +++ b/data/2026/CVE-2026-126180.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a low privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands."}],"id":"CVE-2026-126180","lastModified":"2026-11-11T22:17:16.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.7,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.813","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-225"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1336"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a low privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands."}],"id":"CVE-2026-126180","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.7,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.813","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-225"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1336"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126181.json b/data/2026/CVE-2026-126181.json index 8e478b4dff..f79430fc90 100644 --- a/data/2026/CVE-2026-126181.json +++ b/data/2026/CVE-2026-126181.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions may allow an adjacent-network authenticated attacker with user permission to join the FGFM configuration-sync mesh of the affected FortiGate deployment via the default pre-shared key."}],"id":"CVE-2026-126181","lastModified":"2026-11-11T22:17:16.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.987","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-226"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions may allow an adjacent-network authenticated attacker with user permission to join the FGFM configuration-sync mesh of the affected FortiGate deployment via the default pre-shared key."}],"id":"CVE-2026-126181","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.987","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-226"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126182.json b/data/2026/CVE-2026-126182.json index e0fdd8d52e..b00cf10b9c 100644 --- a/data/2026/CVE-2026-126182.json +++ b/data/2026/CVE-2026-126182.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests."}],"id":"CVE-2026-126182","lastModified":"2026-11-11T22:17:17.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:17.133","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests."}],"id":"CVE-2026-126182","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:17.133","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126183.json b/data/2026/CVE-2026-126183.json index ec5cfbba9f..131b230814 100644 --- a/data/2026/CVE-2026-126183.json +++ b/data/2026/CVE-2026-126183.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the expected scope via specially crafted HTTP request."}],"id":"CVE-2026-126183","lastModified":"2026-11-11T22:17:17.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:17.330","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-228"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the expected scope via specially crafted HTTP request."}],"id":"CVE-2026-126183","lastModified":"2026-11-12T19:16:55.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:43:18.998846Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:17.330","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-228"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126184.json b/data/2026/CVE-2026-126184.json index 5228f89ef3..f738c2b2ed 100644 --- a/data/2026/CVE-2026-126184.json +++ b/data/2026/CVE-2026-126184.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an attacker to disrupt the HA state."}],"id":"CVE-2026-126184","lastModified":"2026-11-11T22:17:17.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:17.603","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-229"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an attacker to disrupt the HA state."}],"id":"CVE-2026-126184","lastModified":"2026-11-12T19:16:55.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126184","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:39:47.960511Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:17.603","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-229"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126185.json b/data/2026/CVE-2026-126185.json index d4df6f76d5..71f97380b9 100644 --- a/data/2026/CVE-2026-126185.json +++ b/data/2026/CVE-2026-126185.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper control of generation of code ('code injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests."}],"id":"CVE-2026-126185","lastModified":"2026-11-11T22:17:17.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:17.830","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-230"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper control of generation of code ('code injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests."}],"id":"CVE-2026-126185","lastModified":"2026-11-12T19:16:55.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:17:14.582476Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:17.830","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-230"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126186.json b/data/2026/CVE-2026-126186.json index 1775b2662a..8da32dcc14 100644 --- a/data/2026/CVE-2026-126186.json +++ b/data/2026/CVE-2026-126186.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to ffprobe (VideoAnalyzer, AudioAnalyzer), ffmpeg (VideoPreviewer) and ImageMagick (ImageAnalyzer, the :mini_magick variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an upload chooses which decoder processes it. An FFmpeg built with AviSynth support treats a file with the .avs extension as an AviSynth script and evaluates it, which could disclose files readable by the application process through the preview image, or load a native library the attacker has also uploaded, possibly leading to remote code execution in the FFmpeg process. ImageMagick selects its coders and delegates from the extension in the same way. An application is affected if it accepts uploads from untrusted users and analyzes video or audio attachments, generates video previews, or processes images with ImageMagick. The AviSynth attack additionally requires an FFmpeg built with --enable-avisynth and the AviSynthPlus runtime on the host. Upstream FFmpeg and the common Linux distribution and Homebrew packages do not enable it; the GPL builds distributed for Windows and Linux from ffmpeg.org do. Other decoders that FFmpeg or ImageMagick select from the extension may be reachable without AviSynth. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126186","lastModified":"2026-11-10T22:18:31.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T22:18:31.843","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/72136ff39153bc8d63ecbc899993848eb3d6573e"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/8106938fb0a595f11006dd1497cd409e27d7d636"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-646"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to ffprobe (VideoAnalyzer, AudioAnalyzer), ffmpeg (VideoPreviewer) and ImageMagick (ImageAnalyzer, the :mini_magick variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an upload chooses which decoder processes it. An FFmpeg built with AviSynth support treats a file with the .avs extension as an AviSynth script and evaluates it, which could disclose files readable by the application process through the preview image, or load a native library the attacker has also uploaded, possibly leading to remote code execution in the FFmpeg process. ImageMagick selects its coders and delegates from the extension in the same way. An application is affected if it accepts uploads from untrusted users and analyzes video or audio attachments, generates video previews, or processes images with ImageMagick. The AviSynth attack additionally requires an FFmpeg built with --enable-avisynth and the AviSynthPlus runtime on the host. Upstream FFmpeg and the common Linux distribution and Homebrew packages do not enable it; the GPL builds distributed for Windows and Linux from ffmpeg.org do. Other decoders that FFmpeg or ImageMagick select from the extension may be reachable without AviSynth. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126186","lastModified":"2026-11-12T18:17:24.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126186","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:30:58.504398Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:31.843","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/72136ff39153bc8d63ecbc899993848eb3d6573e"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/8106938fb0a595f11006dd1497cd409e27d7d636"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-646"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126188.json b/data/2026/CVE-2026-126188.json index b4f815f996..5fb5f3c0a0 100644 --- a/data/2026/CVE-2026-126188.json +++ b/data/2026/CVE-2026-126188.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer pass uploaded blob contents to FFmpeg without restricting the demuxer. A direct upload can retain a client-declared video/* or audio/* content type for an HLS playlist. FFmpeg content probing selects the hls demuxer, which opens attacker-named file:// segments when the blob is previewed or analyzed. Applications that accept untrusted uploads and generate video previews or analyze video or audio attachments can disclose a local media file readable by the application process when the attacker knows its path. This issue is fixed in versions 8.0.5.2 and 8.1.4.1."}],"id":"CVE-2026-126188","lastModified":"2026-11-11T00:18:47.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T00:18:47.267","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/3b1f2627538dc597cd973530c08514a26c2b0282"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/69aff80d115bbb9d1e82fd6c6f2fd3ddeafb958b"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-3f4q-8x5m-76v8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer pass uploaded blob contents to FFmpeg without restricting the demuxer. A direct upload can retain a client-declared video/* or audio/* content type for an HLS playlist. FFmpeg content probing selects the hls demuxer, which opens attacker-named file:// segments when the blob is previewed or analyzed. Applications that accept untrusted uploads and generate video previews or analyze video or audio attachments can disclose a local media file readable by the application process when the attacker knows its path. This issue is fixed in versions 8.0.5.2 and 8.1.4.1."}],"id":"CVE-2026-126188","lastModified":"2026-11-12T20:18:31.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126188","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:14:42.766845Z","version":"2.0.3"}}]},"published":"2026-11-11T00:18:47.267","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/3b1f2627538dc597cd973530c08514a26c2b0282"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/69aff80d115bbb9d1e82fd6c6f2fd3ddeafb958b"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-3f4q-8x5m-76v8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126189.json b/data/2026/CVE-2026-126189.json new file mode 100644 index 0000000000..2b14c784eb --- /dev/null +++ b/data/2026/CVE-2026-126189.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"soupsieve","vendor":"facelessuser","versions":[{"status":"affected","version":"< 4.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1."}],"id":"CVE-2026-126189","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T17:17:32.260","references":[{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/commit/0469c148f5501ec2127e0d65b77c2a1c395fa379"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/commit/305fbf6b8c1f6ff05fec55d1e5bb28d80d22de44"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/pull/352"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/releases/tag/4.0.1"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-8jvp-3x96-xpqw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126190.json b/data/2026/CVE-2026-126190.json new file mode 100644 index 0000000000..2ddcdef182 --- /dev/null +++ b/data/2026/CVE-2026-126190.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"soupsieve","vendor":"facelessuser","versions":[{"status":"affected","version":"< 4.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0."}],"id":"CVE-2026-126190","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T17:17:32.440","references":[{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/pull/351"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/releases/tag/4.0"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64f"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126191.json b/data/2026/CVE-2026-126191.json new file mode 100644 index 0000000000..940f07e57b --- /dev/null +++ b/data/2026/CVE-2026-126191.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"soupsieve","vendor":"facelessuser","versions":[{"status":"affected","version":"< 3.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of an otherwise valid selector. The failure occurs during selector compilation through soupsieve.compile() or Beautiful Soup select() before SELECTOR_LIMIT is applied, so an application that accepts untrusted selector strings can have a worker stalled by a short input. This issue is fixed in version 3.0."}],"id":"CVE-2026-126191","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T17:17:32.627","references":[{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/commit/dbfa2854ff31a863326bd6660d4e55c6f068db9e"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/pull/300"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/releases/tag/3.0"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-6655-6qjp-jx7x"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126192.json b/data/2026/CVE-2026-126192.json new file mode 100644 index 0000000000..0290ced852 --- /dev/null +++ b/data/2026/CVE-2026-126192.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"soupsieve","vendor":"facelessuser","versions":[{"status":"affected","version":"< 2.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.10, matching a developer-authored selector that places the general sibling combinator inside :has() repeatedly scans each candidate element's following siblings when the right-hand side is absent, producing quadratic work on attacker-controlled HTML. Applications that evaluate a fixed selector such as div:has(a ~ b) over untrusted markup can have a worker occupied for minutes by a small document, while the adjacent sibling form and trusted-only document processing are not affected in the same way. This issue is fixed in version 2.10."}],"id":"CVE-2026-126192","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T17:17:32.793","references":[{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/commit/ffb88cca745c591224f74a8e86414a85e8f35fc0"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/pull/304"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/releases/tag/2.10"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-4j63-6c4x-wfg4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126193.json b/data/2026/CVE-2026-126193.json new file mode 100644 index 0000000000..f2c7677480 --- /dev/null +++ b/data/2026/CVE-2026-126193.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"soupsieve","vendor":"facelessuser","versions":[{"status":"affected","version":">= 0.4, < 3.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise  RecursionError . Applications accepting untrusted selectors may experience failure of the affected request or task if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service. This vulnerability is fixed in version 3.0."}],"id":"CVE-2026-126193","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T17:17:32.970","references":[{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/commit/52de12f157a373614ad0f486d434551c5a4378ee"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/pull/306"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/releases/tag/3.0"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-7g44-g9rc-x53w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126196.json b/data/2026/CVE-2026-126196.json new file mode 100644 index 0000000000..591b13f3de --- /dev/null +++ b/data/2026/CVE-2026-126196.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"pgedge-postgres-mcp","vendor":"pgEdge","versions":[{"status":"affected","version":"< 1.1.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, query_database on a read_only connection could send unrecognized statements through pgx Exec without bind parameters, selecting PostgreSQL's simple query protocol and allowing multiple semicolon-separated statements in one request. A caller could combine transaction or session state changes with database writes, and pooled session state could leave later calls writable, when the connecting role held write privileges. The flaw affected deployments relying on read_only as a safety boundary, could compromise integrity and availability, and did not add confidentiality impact beyond the reads already permitted by the connection. This issue is fixed in 1.1.0."}],"id":"CVE-2026-126196","lastModified":"2026-11-12T20:18:31.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126196","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:59.698501Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:24.590","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-j7mp-839j-jrm7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126197.json b/data/2026/CVE-2026-126197.json new file mode 100644 index 0000000000..9ed822ee5f --- /dev/null +++ b/data/2026/CVE-2026-126197.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"pgedge-postgres-mcp","vendor":"pgEdge","versions":[{"status":"affected","version":"< 1.1.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing $mcp_custom_tool$ could terminate the block and inject arbitrary SQL statements, while $mcp_args$ could inject procedural code into a plpgsql block. Because the statement used the simple query protocol, injected text could include additional statements and transaction control, bypassing read_only and accessing data or modifying resources available to the connecting role. The issue requires at least one pl-do custom tool; sql and pl-func tools pass arguments as bind parameters and are not affected by this injection mechanism. This issue is fixed in 1.1.0."}],"id":"CVE-2026-126197","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T18:17:24.780","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/b5b929305de7a22cd6ed7de8ae1be2ac90ca0868"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/pull/196"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-r5pp-jx86-r6r9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126198.json b/data/2026/CVE-2026-126198.json new file mode 100644 index 0000000000..0c085cb992 --- /dev/null +++ b/data/2026/CVE-2026-126198.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"pgedge-postgres-mcp","vendor":"pgEdge","versions":[{"status":"affected","version":"< 1.1.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0."}],"id":"CVE-2026-126198","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T18:17:24.953","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/c86d5cbe6d65c6debd0d0e909ce320271caa4d90"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/pull/198"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-v44x-hxg7-5cgc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-357"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126199.json b/data/2026/CVE-2026-126199.json new file mode 100644 index 0000000000..d8b55a9d71 --- /dev/null +++ b/data/2026/CVE-2026-126199.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"pgedge-postgres-mcp","vendor":"pgEdge","versions":[{"status":"affected","version":"< 1.1.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled CLI and web clients classified query_database statements only by their first keyword before deciding whether to display a write confirmation. SELECT INTO, data-modifying common table expressions beginning with WITH, and EXPLAIN ANALYZE of a write were treated as reads and could execute without confirmation on an allow_writes connection. Read-only connections remain protected by PostgreSQL transaction access mode, and EXPLAIN without ANALYZE and SELECT FOR UPDATE remain classified as reads. This issue is fixed in 1.1.0."}],"id":"CVE-2026-126199","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T18:17:25.123","references":[{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/commit/310c02809891cfaee6e4891cd7bb9aa1d459575c"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/pull/233"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/releases/tag/v1.1.0"},{"source":"security-advisories@github.com","url":"https://github.com/pgEdge/pgedge-postgres-mcp/security/advisories/GHSA-5gmh-9683-hhq9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-357"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126203.json b/data/2026/CVE-2026-126203.json new file mode 100644 index 0000000000..df2ed85bbe --- /dev/null +++ b/data/2026/CVE-2026-126203.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"loofah","vendor":"flavorjones","versions":[{"status":"affected","version":">= 2.21.0, < 2.25.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3."}],"id":"CVE-2026-126203","lastModified":"2026-11-12T20:18:31.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126203","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:20:09.567928Z","version":"2.0.3"}}]},"published":"2026-11-12T19:16:56.517","references":[{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/commit/7ba1e7b77e043fb7dc832ef746fcbf83137135e6"},{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/pull/324"},{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-h6v6-rg66-fqj4"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/commit/635abc8d65c75d594ddf8957fbfbfd822c2c0dbd"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/pull/3741"},{"source":"security-advisories@github.com","url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126204.json b/data/2026/CVE-2026-126204.json new file mode 100644 index 0000000000..76b08a7cec --- /dev/null +++ b/data/2026/CVE-2026-126204.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"express-rate-limit","vendor":"express-rate-limit","versions":[{"status":"affected","version":">= 8.6.0, < 8.7.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"express-rate-limit is a basic rate-limiting middleware for Express. From 8.6.0 until 8.7.2, the built-in MemoryStore returns a Client whose mutable resetTime object is retained by middleware using skipFailedRequests or skipSuccessfulRequests. When a later request resets the client window, MemoryStore.resetClient mutates that same Date, so an earlier request that finishes or disconnects after the reset can pass the stale-window guard and decrement the current window's count. A client able to keep requests in flight across the boundary can obtain a bounded extra burst of up to one additional configured limit in the new window; the behavior does not increase the sustained rate. Stores that return a fresh Date are not affected. This issue is fixed in version 8.7.2."}],"id":"CVE-2026-126204","lastModified":"2026-11-12T19:16:56.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T19:16:56.713","references":[{"source":"security-advisories@github.com","url":"https://github.com/express-rate-limit/express-rate-limit/commit/da5b115b97dd903076d37b19437fbd71445e150b"},{"source":"security-advisories@github.com","url":"https://github.com/express-rate-limit/express-rate-limit/pull/707"},{"source":"security-advisories@github.com","url":"https://github.com/express-rate-limit/express-rate-limit/releases/tag/v8.7.2"},{"source":"security-advisories@github.com","url":"https://github.com/express-rate-limit/express-rate-limit/security/advisories/GHSA-j3cq-92fq-qg5f"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-682"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126211.json b/data/2026/CVE-2026-126211.json index 3c613142ac..8254831035 100644 --- a/data/2026/CVE-2026-126211.json +++ b/data/2026/CVE-2026-126211.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.8","status":"affected","version":"7.6.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.8","status":"affected","version":"7.6.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.1 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.1 through 7.6.8, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.1 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.1 through 7.6.8 may allow an authenticated privileged attacker to elevate their privileges via crafted JSON-RPC request."}],"id":"CVE-2026-126211","lastModified":"2026-11-11T22:17:18.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:18.100","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-231"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.8","status":"affected","version":"7.6.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.8","status":"affected","version":"7.6.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.1 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.1 through 7.6.8, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.1 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.1 through 7.6.8 may allow an authenticated privileged attacker to elevate their privileges via crafted JSON-RPC request."}],"id":"CVE-2026-126211","lastModified":"2026-11-12T19:16:56.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126211","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:54:40.908519Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:18.100","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-231"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126212.json b/data/2026/CVE-2026-126212.json index 034347f683..d2e70037c6 100644 --- a/data/2026/CVE-2026-126212.json +++ b/data/2026/CVE-2026-126212.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests."}],"id":"CVE-2026-126212","lastModified":"2026-11-11T22:17:18.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:18.263","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-232"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests."}],"id":"CVE-2026-126212","lastModified":"2026-11-12T19:16:57.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126212","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:41:37.578715Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:18.263","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-232"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126213.json b/data/2026/CVE-2026-126213.json index ca1213ae7f..39a78bbf9c 100644 --- a/data/2026/CVE-2026-126213.json +++ b/data/2026/CVE-2026-126213.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests."}],"id":"CVE-2026-126213","lastModified":"2026-11-11T22:17:18.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:18.457","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-233"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests."}],"id":"CVE-2026-126213","lastModified":"2026-11-12T19:16:57.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126213","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:54:54.758659Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:18.457","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-233"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126214.json b/data/2026/CVE-2026-126214.json index cd1ec3a4b0..bd97b7f9d6 100644 --- a/data/2026/CVE-2026-126214.json +++ b/data/2026/CVE-2026-126214.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126214","lastModified":"2026-11-12T16:19:01.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126214","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:35:53.414778Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:18.663","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126214","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126214","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:35:53.414778Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:18.663","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126215.json b/data/2026/CVE-2026-126215.json index 24e45131d9..d2680bd2f5 100644 --- a/data/2026/CVE-2026-126215.json +++ b/data/2026/CVE-2026-126215.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126215","lastModified":"2026-11-12T16:19:01.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126215","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:23:16.598599Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:18.860","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126215","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126215","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:23:16.598599Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:18.860","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126216.json b/data/2026/CVE-2026-126216.json index b7adf17f81..f04e4a544b 100644 --- a/data/2026/CVE-2026-126216.json +++ b/data/2026/CVE-2026-126216.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126216","lastModified":"2026-11-12T16:19:01.553","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126216","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:19:12.350875Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:19.083","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126216","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126216","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:19:12.350875Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:19.083","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126217.json b/data/2026/CVE-2026-126217.json index 5fc1f0ce57..9f4382cf56 100644 --- a/data/2026/CVE-2026-126217.json +++ b/data/2026/CVE-2026-126217.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126217","lastModified":"2026-11-11T22:17:19.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.240","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126217","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.240","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126218.json b/data/2026/CVE-2026-126218.json index ac827ebf30..d570145cea 100644 --- a/data/2026/CVE-2026-126218.json +++ b/data/2026/CVE-2026-126218.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP requests."}],"id":"CVE-2026-126218","lastModified":"2026-11-11T22:17:19.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.457","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-235"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP requests."}],"id":"CVE-2026-126218","lastModified":"2026-11-12T19:16:57.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126218","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:12:13.634795Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:19.457","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-235"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126219.json b/data/2026/CVE-2026-126219.json index e002abcc24..c96fe7f3bf 100644 --- a/data/2026/CVE-2026-126219.json +++ b/data/2026/CVE-2026-126219.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI."}],"id":"CVE-2026-126219","lastModified":"2026-11-11T22:17:19.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.610","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI."}],"id":"CVE-2026-126219","lastModified":"2026-11-12T19:16:57.587","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126219","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:36:23.082976Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:19.610","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126220.json b/data/2026/CVE-2026-126220.json index b88ff2fda3..b996d0f298 100644 --- a/data/2026/CVE-2026-126220.json +++ b/data/2026/CVE-2026-126220.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI."}],"id":"CVE-2026-126220","lastModified":"2026-11-11T22:17:19.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.790","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI."}],"id":"CVE-2026-126220","lastModified":"2026-11-12T19:16:57.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126220","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:29:05.498632Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:19.790","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126221.json b/data/2026/CVE-2026-126221.json index 9a1b1a4245..781c636cb8 100644 --- a/data/2026/CVE-2026-126221.json +++ b/data/2026/CVE-2026-126221.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI."}],"id":"CVE-2026-126221","lastModified":"2026-11-11T22:17:19.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.930","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI."}],"id":"CVE-2026-126221","lastModified":"2026-11-12T19:16:59.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126221","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:42:32.814900Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:19.930","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126222.json b/data/2026/CVE-2026-126222.json index 6ce64433e1..45ba633f86 100644 --- a/data/2026/CVE-2026-126222.json +++ b/data/2026/CVE-2026-126222.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.3 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.3 through 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.3 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.3 through 7.6.7 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126222","lastModified":"2026-11-11T22:17:20.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:20.100","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-237"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.3 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.3 through 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.3 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.3 through 7.6.7 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126222","lastModified":"2026-11-12T19:16:59.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126222","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:53:06.418355Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:20.100","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-237"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126223.json b/data/2026/CVE-2026-126223.json index 2f038d078b..b67078c398 100644 --- a/data/2026/CVE-2026-126223.json +++ b/data/2026/CVE-2026-126223.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests."}],"id":"CVE-2026-126223","lastModified":"2026-11-11T22:17:20.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:20.243","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-238"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests."}],"id":"CVE-2026-126223","lastModified":"2026-11-12T19:16:59.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126223","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:39:29.479773Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:20.243","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-238"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126224.json b/data/2026/CVE-2026-126224.json index ae8aa75713..28058a26a7 100644 --- a/data/2026/CVE-2026-126224.json +++ b/data/2026/CVE-2026-126224.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged admin user to execute unauthorized code or commands."}],"id":"CVE-2026-126224","lastModified":"2026-11-12T16:19:01.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126224","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:36:43.729771Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:20.437","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-239"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged admin user to execute unauthorized code or commands."}],"id":"CVE-2026-126224","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126224","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:36:43.729771Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:20.437","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-239"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126225.json b/data/2026/CVE-2026-126225.json index 22a67084d2..84f419b16f 100644 --- a/data/2026/CVE-2026-126225.json +++ b/data/2026/CVE-2026-126225.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.7 may allow an authenticated attacker to elevate their privileges via crafted JSON-RPC request."}],"id":"CVE-2026-126225","lastModified":"2026-11-11T22:17:20.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:20.660","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-240"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.7 may allow an authenticated attacker to elevate their privileges via crafted JSON-RPC request."}],"id":"CVE-2026-126225","lastModified":"2026-11-12T19:17:00.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126225","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:27:43.903976Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:20.660","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-240"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126226.json b/data/2026/CVE-2026-126226.json index 744e73f89d..575855c28b 100644 --- a/data/2026/CVE-2026-126226.json +++ b/data/2026/CVE-2026-126226.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted report schedule name."}],"id":"CVE-2026-126226","lastModified":"2026-11-11T22:17:20.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:20.793","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-241"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted report schedule name."}],"id":"CVE-2026-126226","lastModified":"2026-11-12T19:17:00.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126226","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:34:39.162549Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:20.793","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-241"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126227.json b/data/2026/CVE-2026-126227.json index 59993ed8ee..30fe0a77b6 100644 --- a/data/2026/CVE-2026-126227.json +++ b/data/2026/CVE-2026-126227.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the intended scope via specially crafted HTTP request"}],"id":"CVE-2026-126227","lastModified":"2026-11-11T22:17:21.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.003","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-242"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the intended scope via specially crafted HTTP request"}],"id":"CVE-2026-126227","lastModified":"2026-11-12T19:17:00.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126227","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:28:52.051087Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:21.003","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-242"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126228.json b/data/2026/CVE-2026-126228.json index 49b5bf4342..e76515ff9d 100644 --- a/data/2026/CVE-2026-126228.json +++ b/data/2026/CVE-2026-126228.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.4 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.4 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.4 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.4 through 7.2.12 may allow an authenticated remote attacker with admin privileges to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126228","lastModified":"2026-11-12T16:19:01.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126228","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:20:40.315014Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:21.243","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-243"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.4 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.4 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.4 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.4 through 7.2.12 may allow an authenticated remote attacker with admin privileges to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126228","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126228","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:20:40.315014Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:21.243","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-243"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126229.json b/data/2026/CVE-2026-126229.json index b2e4a49249..fce76b5819 100644 --- a/data/2026/CVE-2026-126229.json +++ b/data/2026/CVE-2026-126229.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiAnalyzer Cloud 7.0 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager 7.0 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12, FortiManager Cloud 7.0 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests."}],"id":"CVE-2026-126229","lastModified":"2026-11-12T11:17:11.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.447","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-244"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiAnalyzer Cloud 7.0 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager 7.0 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12, FortiManager Cloud 7.0 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests."}],"id":"CVE-2026-126229","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.447","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-244"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126230.json b/data/2026/CVE-2026-126230.json index 23fb695b2f..72927110ca 100644 --- a/data/2026/CVE-2026-126230.json +++ b/data/2026/CVE-2026-126230.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted requests."}],"id":"CVE-2026-126230","lastModified":"2026-11-11T22:17:21.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.697","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-245"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted requests."}],"id":"CVE-2026-126230","lastModified":"2026-11-12T19:17:00.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126230","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:34:53.657840Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:21.697","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-245"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126231.json b/data/2026/CVE-2026-126231.json index 7b406cf35f..7f515c355b 100644 --- a/data/2026/CVE-2026-126231.json +++ b/data/2026/CVE-2026-126231.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated attacker to execute unauthorized commands via a crafted HTTP request."}],"id":"CVE-2026-126231","lastModified":"2026-11-11T22:17:21.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.930","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-246"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated attacker to execute unauthorized commands via a crafted HTTP request."}],"id":"CVE-2026-126231","lastModified":"2026-11-12T19:17:00.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126231","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:38:18.018602Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:21.930","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-246"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126232.json b/data/2026/CVE-2026-126232.json index 26f5d2f448..66a9bde95f 100644 --- a/data/2026/CVE-2026-126232.json +++ b/data/2026/CVE-2026-126232.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper certificate validation vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a MITM attacker to impersonate the radius server via a rogue RADIUS server."}],"id":"CVE-2026-126232","lastModified":"2026-11-11T22:17:22.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.157","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-247"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper certificate validation vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a MITM attacker to impersonate the radius server via a rogue RADIUS server."}],"id":"CVE-2026-126232","lastModified":"2026-11-12T19:17:01.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126232","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:19:10.522308Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:22.157","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-247"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126233.json b/data/2026/CVE-2026-126233.json index b9773236ff..2d891f75f1 100644 --- a/data/2026/CVE-2026-126233.json +++ b/data/2026/CVE-2026-126233.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to upload arbitrary files via specially crafted requests."}],"id":"CVE-2026-126233","lastModified":"2026-11-11T22:17:22.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.377","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-248"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to upload arbitrary files via specially crafted requests."}],"id":"CVE-2026-126233","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.377","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-248"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126234.json b/data/2026/CVE-2026-126234.json index e703cf3df8..a5168e52e0 100644 --- a/data/2026/CVE-2026-126234.json +++ b/data/2026/CVE-2026-126234.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126234","lastModified":"2026-11-11T22:17:22.607","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.607","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-249"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1336"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126234","lastModified":"2026-11-12T19:17:01.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126234","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:42:53.231977Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:22.607","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-249"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1336"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126235.json b/data/2026/CVE-2026-126235.json index 0e52de2038..e0f31bc9ac 100644 --- a/data/2026/CVE-2026-126235.json +++ b/data/2026/CVE-2026-126235.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.2","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.7","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.10","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.2","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.7","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.10","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.2 through 7.6.7, FortiAnalyzer 7.4.7 through 7.4.11, FortiAnalyzer 7.2.10 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.2 through 7.6.7, FortiManager 7.4.7 through 7.4.11, FortiManager 7.2.10 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to write arbitrary files via a specially crafted archive."}],"id":"CVE-2026-126235","lastModified":"2026-11-11T22:17:22.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.753","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-250"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.2","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.7","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.10","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.2","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.7","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.10","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.2 through 7.6.7, FortiAnalyzer 7.4.7 through 7.4.11, FortiAnalyzer 7.2.10 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.2 through 7.6.7, FortiManager 7.4.7 through 7.4.11, FortiManager 7.2.10 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to write arbitrary files via a specially crafted archive."}],"id":"CVE-2026-126235","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.753","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-250"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126236.json b/data/2026/CVE-2026-126236.json index eb223b1128..eb7f455058 100644 --- a/data/2026/CVE-2026-126236.json +++ b/data/2026/CVE-2026-126236.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests"}],"id":"CVE-2026-126236","lastModified":"2026-11-12T16:19:02.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126236","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:32:10.652407Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:22.960","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-251"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests"}],"id":"CVE-2026-126236","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126236","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:32:10.652407Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:22.960","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-251"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126237.json b/data/2026/CVE-2026-126237.json index ac61c02475..588b36e58f 100644 --- a/data/2026/CVE-2026-126237.json +++ b/data/2026/CVE-2026-126237.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A loop with unreachable exit condition ('infinite loop') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to cause a denial of service via crafted TCP requests."}],"id":"CVE-2026-126237","lastModified":"2026-11-11T22:17:23.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:23.177","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-252"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A loop with unreachable exit condition ('infinite loop') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to cause a denial of service via crafted TCP requests."}],"id":"CVE-2026-126237","lastModified":"2026-11-12T19:17:01.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126237","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:42:41.635702Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:23.177","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-252"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126238.json b/data/2026/CVE-2026-126238.json index 77de680b7e..1b57d68476 100644 --- a/data/2026/CVE-2026-126238.json +++ b/data/2026/CVE-2026-126238.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality."}],"id":"CVE-2026-126238","lastModified":"2026-11-12T16:19:02.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126238","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:24:40.270091Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:23.313","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-253"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality."}],"id":"CVE-2026-126238","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126238","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:24:40.270091Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:23.313","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-253"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126239.json b/data/2026/CVE-2026-126239.json index b9f32fc707..e811b97b31 100644 --- a/data/2026/CVE-2026-126239.json +++ b/data/2026/CVE-2026-126239.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests"}],"id":"CVE-2026-126239","lastModified":"2026-11-12T16:19:02.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126239","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:32:33.301986Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:23.460","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-254"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests"}],"id":"CVE-2026-126239","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126239","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:32:33.301986Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:23.460","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-254"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126240.json b/data/2026/CVE-2026-126240.json index c2fb5ad8d7..771ee72869 100644 --- a/data/2026/CVE-2026-126240.json +++ b/data/2026/CVE-2026-126240.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username)."}],"id":"CVE-2026-126240","lastModified":"2026-11-11T22:17:23.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:23.617","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-255"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-90"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username)."}],"id":"CVE-2026-126240","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:23.617","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-255"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-90"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126241.json b/data/2026/CVE-2026-126241.json index 8d7e60c48e..aa178a7a0a 100644 --- a/data/2026/CVE-2026-126241.json +++ b/data/2026/CVE-2026-126241.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"},{"lessThanOrEqual":"6.5.7","status":"affected","version":"6.5.2","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database."}],"id":"CVE-2026-126241","lastModified":"2026-11-12T16:19:02.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:32:23.809283Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:23.753","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-256"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"},{"lessThanOrEqual":"6.5.7","status":"affected","version":"6.5.2","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database."}],"id":"CVE-2026-126241","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:32:23.809283Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:23.753","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-256"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126242.json b/data/2026/CVE-2026-126242.json index ea97e646ec..36beeac83b 100644 --- a/data/2026/CVE-2026-126242.json +++ b/data/2026/CVE-2026-126242.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means."}],"id":"CVE-2026-126242","lastModified":"2026-11-11T22:17:23.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:23.893","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means."}],"id":"CVE-2026-126242","lastModified":"2026-11-12T19:17:01.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126242","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:59:18.642880Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:23.893","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126243.json b/data/2026/CVE-2026-126243.json index d49ea938c7..dc04ab7f55 100644 --- a/data/2026/CVE-2026-126243.json +++ b/data/2026/CVE-2026-126243.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means."}],"id":"CVE-2026-126243","lastModified":"2026-11-11T22:17:24.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:24.020","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means."}],"id":"CVE-2026-126243","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:24.020","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126244.json b/data/2026/CVE-2026-126244.json index 298c5e5386..b874e3beac 100644 --- a/data/2026/CVE-2026-126244.json +++ b/data/2026/CVE-2026-126244.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS)."}],"id":"CVE-2026-126244","lastModified":"2026-11-12T16:19:02.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126244","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:30:57.923748Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.147","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-258"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS)."}],"id":"CVE-2026-126244","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126244","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:30:57.923748Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.147","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-258"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126245.json b/data/2026/CVE-2026-126245.json index 8463e502ab..28cfcca5da 100644 --- a/data/2026/CVE-2026-126245.json +++ b/data/2026/CVE-2026-126245.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to execute unauthorized code or commands via http requests, should the attacker be able to defeat ASLR protections."}],"id":"CVE-2026-126245","lastModified":"2026-11-12T16:19:02.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126245","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:30:47.072900Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.280","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-259"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to execute unauthorized code or commands via http requests, should the attacker be able to defeat ASLR protections."}],"id":"CVE-2026-126245","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126245","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:30:47.072900Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.280","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-259"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126246.json b/data/2026/CVE-2026-126246.json index 1f43eafcc3..9d02da8ca0 100644 --- a/data/2026/CVE-2026-126246.json +++ b/data/2026/CVE-2026-126246.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A null pointer dereference vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform a denial of service attack via http requests."}],"id":"CVE-2026-126246","lastModified":"2026-11-12T16:19:02.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126246","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:47.851311Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.423","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-260"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A null pointer dereference vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform a denial of service attack via http requests."}],"id":"CVE-2026-126246","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126246","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:47.851311Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.423","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-260"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126247.json b/data/2026/CVE-2026-126247.json index 7611b6e98e..60ca34aaee 100644 --- a/data/2026/CVE-2026-126247.json +++ b/data/2026/CVE-2026-126247.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated privileged attacker to execute unauthorized code or commands via http requests."}],"id":"CVE-2026-126247","lastModified":"2026-11-12T16:19:03.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126247","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:30:08.683090Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.560","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-261"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated privileged attacker to execute unauthorized code or commands via http requests."}],"id":"CVE-2026-126247","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126247","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:30:08.683090Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.560","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-261"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126248.json b/data/2026/CVE-2026-126248.json index ad3b9c58b7..f7cb33472e 100644 --- a/data/2026/CVE-2026-126248.json +++ b/data/2026/CVE-2026-126248.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A insufficiently protected credentials vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to obtain sensitive information via HTTPS requests."}],"id":"CVE-2026-126248","lastModified":"2026-11-12T16:19:03.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126248","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:35.163797Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.693","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-262"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A insufficiently protected credentials vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to obtain sensitive information via HTTPS requests."}],"id":"CVE-2026-126248","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126248","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:35.163797Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.693","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-262"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126249.json b/data/2026/CVE-2026-126249.json index 290dc3a3e7..499b34091a 100644 --- a/data/2026/CVE-2026-126249.json +++ b/data/2026/CVE-2026-126249.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to escalate privileges."}],"id":"CVE-2026-126249","lastModified":"2026-11-12T16:19:03.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126249","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:57.484614Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.823","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-263"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to escalate privileges."}],"id":"CVE-2026-126249","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126249","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:57.484614Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.823","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-263"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126250.json b/data/2026/CVE-2026-126250.json index 5abd321890..9c4b2e5854 100644 --- a/data/2026/CVE-2026-126250.json +++ b/data/2026/CVE-2026-126250.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to cause a denial of service via HTTP requests."}],"id":"CVE-2026-126250","lastModified":"2026-11-12T16:19:03.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126250","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:26.341792Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.960","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-264"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to cause a denial of service via HTTP requests."}],"id":"CVE-2026-126250","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126250","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:26.341792Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:24.960","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-264"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126251.json b/data/2026/CVE-2026-126251.json index 53bec91c72..1f89161c92 100644 --- a/data/2026/CVE-2026-126251.json +++ b/data/2026/CVE-2026-126251.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access."}],"id":"CVE-2026-126251","lastModified":"2026-11-12T16:19:03.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126251","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:15.659135Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:25.087","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-265"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access."}],"id":"CVE-2026-126251","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126251","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:15.659135Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:25.087","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-265"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126252.json b/data/2026/CVE-2026-126252.json index cf242c0d89..790ad72826 100644 --- a/data/2026/CVE-2026-126252.json +++ b/data/2026/CVE-2026-126252.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests"}],"id":"CVE-2026-126252","lastModified":"2026-11-12T16:19:03.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126252","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:06.148068Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:25.220","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-266"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests"}],"id":"CVE-2026-126252","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126252","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:29:06.148068Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:25.220","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-266"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126253.json b/data/2026/CVE-2026-126253.json index 626f271148..460f4174db 100644 --- a/data/2026/CVE-2026-126253.json +++ b/data/2026/CVE-2026-126253.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request"}],"id":"CVE-2026-126253","lastModified":"2026-11-12T16:19:03.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126253","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:28:34.906672Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:25.347","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-267"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-305"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request"}],"id":"CVE-2026-126253","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126253","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:28:34.906672Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:25.347","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-267"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-305"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126254.json b/data/2026/CVE-2026-126254.json index 2f08990761..fa45639179 100644 --- a/data/2026/CVE-2026-126254.json +++ b/data/2026/CVE-2026-126254.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted request"}],"id":"CVE-2026-126254","lastModified":"2026-11-12T16:19:03.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126254","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:23:11.716616Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:25.490","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-268"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-197"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted request"}],"id":"CVE-2026-126254","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126254","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:23:11.716616Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:25.490","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-268"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-197"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126255.json b/data/2026/CVE-2026-126255.json index 45c0f8493a..6d2a1ccce1 100644 --- a/data/2026/CVE-2026-126255.json +++ b/data/2026/CVE-2026-126255.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortipam:1.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.5.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.5.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.3.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiPAM","vendor":"Fortinet","versions":[{"lessThanOrEqual":"1.6.2","status":"affected","version":"1.6.0","versionType":"semver"},{"lessThanOrEqual":"1.5.1","status":"affected","version":"1.5.0","versionType":"semver"},{"lessThanOrEqual":"1.4.3","status":"affected","version":"1.4.0","versionType":"semver"},{"lessThanOrEqual":"1.3.1","status":"affected","version":"1.3.0","versionType":"semver"},{"status":"affected","version":"1.2.0"},{"lessThanOrEqual":"1.1.2","status":"affected","version":"1.1.0","versionType":"semver"},{"lessThanOrEqual":"1.0.3","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials."}],"id":"CVE-2026-126255","lastModified":"2026-11-11T22:17:25.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.623","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-269"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-24"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortipam:1.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.5.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.5.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.3.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiPAM","vendor":"Fortinet","versions":[{"lessThanOrEqual":"1.6.2","status":"affected","version":"1.6.0","versionType":"semver"},{"lessThanOrEqual":"1.5.1","status":"affected","version":"1.5.0","versionType":"semver"},{"lessThanOrEqual":"1.4.3","status":"affected","version":"1.4.0","versionType":"semver"},{"lessThanOrEqual":"1.3.1","status":"affected","version":"1.3.0","versionType":"semver"},{"status":"affected","version":"1.2.0"},{"lessThanOrEqual":"1.1.2","status":"affected","version":"1.1.0","versionType":"semver"},{"lessThanOrEqual":"1.0.3","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials."}],"id":"CVE-2026-126255","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.623","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-269"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-24"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126256.json b/data/2026/CVE-2026-126256.json index 1a8a9f59d8..b2f7c0fa5a 100644 --- a/data/2026/CVE-2026-126256.json +++ b/data/2026/CVE-2026-126256.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets."}],"id":"CVE-2026-126256","lastModified":"2026-11-12T16:19:04.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126256","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:10:37.687724Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:25.783","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-270"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets."}],"id":"CVE-2026-126256","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126256","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:10:37.687724Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:25.783","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-270"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126257.json b/data/2026/CVE-2026-126257.json index d95e04d0f3..de98c19197 100644 --- a/data/2026/CVE-2026-126257.json +++ b/data/2026/CVE-2026-126257.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access."}],"id":"CVE-2026-126257","lastModified":"2026-11-11T22:17:25.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.930","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-271"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-259"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access."}],"id":"CVE-2026-126257","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.930","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-271"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-259"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126258.json b/data/2026/CVE-2026-126258.json index 61a9c4d88e..1ae7ce60f3 100644 --- a/data/2026/CVE-2026-126258.json +++ b/data/2026/CVE-2026-126258.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"status":"affected","version":"7.6.7"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests."}],"id":"CVE-2026-126258","lastModified":"2026-11-12T16:19:04.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126258","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:10:05.875958Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:26.073","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-272"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"status":"affected","version":"7.6.7"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests."}],"id":"CVE-2026-126258","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126258","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:10:05.875958Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:26.073","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-272"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126259.json b/data/2026/CVE-2026-126259.json index 8c11951284..42f8c4a057 100644 --- a/data/2026/CVE-2026-126259.json +++ b/data/2026/CVE-2026-126259.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets."}],"id":"CVE-2026-126259","lastModified":"2026-11-12T16:19:04.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126259","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:11:13.113815Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:26.200","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-273"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets."}],"id":"CVE-2026-126259","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126259","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:11:13.113815Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:26.200","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-273"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126261.json b/data/2026/CVE-2026-126261.json index c206b0851e..5279de56d1 100644 --- a/data/2026/CVE-2026-126261.json +++ b/data/2026/CVE-2026-126261.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.5","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.8","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets."}],"id":"CVE-2026-126261","lastModified":"2026-11-10T23:17:20.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-10T23:17:20.897","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-275"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"psirt@fortinet.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.5","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.8","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets."}],"id":"CVE-2026-126261","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-10T23:17:20.897","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-275"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"psirt@fortinet.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126262.json b/data/2026/CVE-2026-126262.json index 5464f66bd0..353fff61c7 100644 --- a/data/2026/CVE-2026-126262.json +++ b/data/2026/CVE-2026-126262.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets."}],"id":"CVE-2026-126262","lastModified":"2026-11-12T16:19:04.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126262","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:16:08.623116Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:26.343","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-276"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets."}],"id":"CVE-2026-126262","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126262","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:16:08.623116Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:26.343","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-276"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126263.json b/data/2026/CVE-2026-126263.json index 3642f3c313..be65a73439 100644 --- a/data/2026/CVE-2026-126263.json +++ b/data/2026/CVE-2026-126263.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests."}],"id":"CVE-2026-126263","lastModified":"2026-11-12T16:19:04.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126263","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:13:11.710205Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:26.520","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-277"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests."}],"id":"CVE-2026-126263","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126263","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:13:11.710205Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:26.520","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-277"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126329.json b/data/2026/CVE-2026-126329.json index 789da3bdd4..bf586f4e19 100644 --- a/data/2026/CVE-2026-126329.json +++ b/data/2026/CVE-2026-126329.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["MacOS","Linux"],"product":"Docker Sandboxes","vendor":"Docker","versions":[{"lessThan":"0.53.0","status":"affected","version":"0.7.0","versionType":"semver"},{"lessThan":"*","status":"unaffected","version":"0.53.0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDG_STATE_HOME pointing to an attacker-controlled location, a local unprivileged user can substitute control-plane sockets and configuration trusted by the root process, potentially executing commands as root. Exploitation requires a privileged invocation with an attacker-influenced environment. The issue affects Linux and macOS and is fixed in version 0.53.0."}],"id":"CVE-2026-126329","lastModified":"2026-11-12T16:19:04.663","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-12T16:19:04.663","references":[{"source":"security@docker.com","url":"https://docs.docker.com/ai/sandboxes/"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-282"}],"source":"security@docker.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["MacOS","Linux"],"product":"Docker Sandboxes","vendor":"Docker","versions":[{"lessThan":"0.53.0","status":"affected","version":"0.7.0","versionType":"semver"},{"lessThan":"*","status":"unaffected","version":"0.53.0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDG_STATE_HOME pointing to an attacker-controlled location, a local unprivileged user can substitute control-plane sockets and configuration trusted by the root process, potentially executing commands as root. Exploitation requires a privileged invocation with an attacker-influenced environment. The issue affects Linux and macOS and is fixed in version 0.53.0."}],"id":"CVE-2026-126329","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-12T16:19:04.663","references":[{"source":"security@docker.com","url":"https://docs.docker.com/ai/sandboxes/"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-282"}],"source":"security@docker.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126330.json b/data/2026/CVE-2026-126330.json index 2a1aef499e..59bfd64240 100644 --- a/data/2026/CVE-2026-126330.json +++ b/data/2026/CVE-2026-126330.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Docker Sandboxes","vendor":"Docker","versions":[{"lessThan":"0.53.0","status":"affected","version":"0.34.0","versionType":"semver"},{"lessThan":"*","status":"unaffected","version":"0.53.0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox restart to publish the service again on a new host port. An attacker able to reach the restored endpoint may regain access to the service. Both TCP and UDP mappings are affected. Exposure is limited to the original bind address, which defaults to loopback. The issue is fixed in version 0.53.0."}],"id":"CVE-2026-126330","lastModified":"2026-11-12T16:19:04.810","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.4,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-12T16:19:04.810","references":[{"source":"security@docker.com","url":"https://docs.docker.com/ai/sandboxes/"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"security@docker.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Docker Sandboxes","vendor":"Docker","versions":[{"lessThan":"0.53.0","status":"affected","version":"0.34.0","versionType":"semver"},{"lessThan":"*","status":"unaffected","version":"0.53.0","versionType":"semver"}]}],"source":"security@docker.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox restart to publish the service again on a new host port. An attacker able to reach the restored endpoint may regain access to the service. Both TCP and UDP mappings are affected. Exposure is limited to the original bind address, which defaults to loopback. The issue is fixed in version 0.53.0."}],"id":"CVE-2026-126330","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.4,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@docker.com","type":"Secondary"}]},"published":"2026-11-12T16:19:04.810","references":[{"source":"security@docker.com","url":"https://docs.docker.com/ai/sandboxes/"}],"sourceIdentifier":"security@docker.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"security@docker.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126496.json b/data/2026/CVE-2026-126496.json index ed9dc2c1c5..e652c128d2 100644 --- a/data/2026/CVE-2026-126496.json +++ b/data/2026/CVE-2026-126496.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/1Panel-dev/CordysCRM","product":"CordysCRM","repo":"https://github.com/1Panel-dev/CordysCRM","vendor":"1Panel-dev","versions":[{"lessThan":"1.9.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read permission can request GET /account/contact/get/{id} with another contact's ID to obtain names, phone numbers, owners, departments, linked customers and custom fields."}],"id":"CVE-2026-126496","lastModified":"2026-11-11T01:17:14.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T01:17:14.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM"},{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM/blob/v1.9.5/backend/crm/src/main/java/cn/cordys/crm/customer/controller/CustomerContactController.java#L96-L102"},{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM/blob/v1.9.5/backend/crm/src/main/java/cn/cordys/crm/customer/service/CustomerContactService.java#L220-L226"},{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM/commit/a48c6587216810bfad20b398585a51c41842184e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM/issues/3891"},{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.9.6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/1panel-dev-cordyscrm-before-1.9.6-authorization-bypass-via-account-contact-get-id"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/1Panel-dev/CordysCRM","product":"CordysCRM","repo":"https://github.com/1Panel-dev/CordysCRM","vendor":"1Panel-dev","versions":[{"lessThan":"1.9.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read permission can request GET /account/contact/get/{id} with another contact's ID to obtain names, phone numbers, owners, departments, linked customers and custom fields."}],"id":"CVE-2026-126496","lastModified":"2026-11-12T18:17:25.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126496","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:56.822757Z","version":"2.0.3"}}]},"published":"2026-11-11T01:17:14.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM"},{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM/blob/v1.9.5/backend/crm/src/main/java/cn/cordys/crm/customer/controller/CustomerContactController.java#L96-L102"},{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM/blob/v1.9.5/backend/crm/src/main/java/cn/cordys/crm/customer/service/CustomerContactService.java#L220-L226"},{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM/commit/a48c6587216810bfad20b398585a51c41842184e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM/issues/3891"},{"source":"disclosure@vulncheck.com","url":"https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.9.6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/1panel-dev-cordyscrm-before-1.9.6-authorization-bypass-via-account-contact-get-id"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126497.json b/data/2026/CVE-2026-126497.json index b77b540471..af40928fc0 100644 --- a/data/2026/CVE-2026-126497.json +++ b/data/2026/CVE-2026-126497.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/LibreCAD/LibreCAD","product":"LibreCAD","repo":"https://github.com/LibreCAD/LibreCAD","vendor":"LibreCAD","versions":[{"lessThanOrEqual":"2.2.1.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution."}],"id":"CVE-2026-126497","lastModified":"2026-11-11T01:17:14.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T01:17:14.597","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/LibreCAD/LibreCAD"},{"source":"disclosure@vulncheck.com","url":"https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgreader18.cpp#L113-L173"},{"source":"disclosure@vulncheck.com","url":"https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/LibreCAD/LibreCAD/issues/3256"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/LibreCAD/LibreCAD","product":"LibreCAD","repo":"https://github.com/LibreCAD/LibreCAD","vendor":"LibreCAD","versions":[{"lessThanOrEqual":"2.2.1.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution."}],"id":"CVE-2026-126497","lastModified":"2026-11-12T20:18:31.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126497","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:15:37.141006Z","version":"2.0.3"}}]},"published":"2026-11-11T01:17:14.597","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/LibreCAD/LibreCAD"},{"source":"disclosure@vulncheck.com","url":"https://github.com/LibreCAD/LibreCAD/blob/v2.2.1.6/libraries/libdxfrw/src/intern/dwgreader18.cpp#L113-L173"},{"source":"disclosure@vulncheck.com","url":"https://github.com/LibreCAD/LibreCAD/commit/17ba2b273b89cc9c8b6fcf71882e327ccf1eebf6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/LibreCAD/LibreCAD/issues/3256"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/librecad-through-2.2.1.6-heap-out-of-bounds-write-via-dwgreader18-parsedatapage"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126539.json b/data/2026/CVE-2026-126539.json index 61408223ca..c18be754cc 100644 --- a/data/2026/CVE-2026-126539.json +++ b/data/2026/CVE-2026-126539.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/directus","product":"directus","repo":"https://github.com/directus/directus","vendor":"directus","versions":[{"lessThan":"12.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection."}],"id":"CVE-2026-126539","lastModified":"2026-11-11T01:17:15.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T01:17:15.173","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/directus/directus/blob/v12.0.2/api/src/websocket/controllers/base.ts#L381-L397"},{"source":"disclosure@vulncheck.com","url":"https://github.com/directus/directus/commit/8d4cd86783bcbf5444eaf290e8dcecb33929300e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/directus/directus/releases/tag/v12.1.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/directus/directus/security/advisories/GHSA-97xr-jchp-xm3c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/directus-before-12.1.0-authorization-bypass-via-public-websocket-rest-interface"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-636"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/directus","product":"directus","repo":"https://github.com/directus/directus","vendor":"directus","versions":[{"lessThan":"12.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection."}],"id":"CVE-2026-126539","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:31:03.786110Z","version":"2.0.3"}}]},"published":"2026-11-11T01:17:15.173","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/directus/directus/blob/v12.0.2/api/src/websocket/controllers/base.ts#L381-L397"},{"source":"disclosure@vulncheck.com","url":"https://github.com/directus/directus/commit/8d4cd86783bcbf5444eaf290e8dcecb33929300e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/directus/directus/releases/tag/v12.1.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/directus/directus/security/advisories/GHSA-97xr-jchp-xm3c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/directus-before-12.1.0-authorization-bypass-via-public-websocket-rest-interface"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-636"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126541.json b/data/2026/CVE-2026-126541.json index 4c27e166c0..3dde0f6ac3 100644 --- a/data/2026/CVE-2026-126541.json +++ b/data/2026/CVE-2026-126541.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","repo":"https://github.com/WWBN/AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php to retrieve victims' HLS URLs and stream keys, then publish as the victim or restream private or pay-per-view lives."}],"id":"CVE-2026-126541","lastModified":"2026-11-11T01:17:15.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T01:17:15.357","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/Live/view/Live_restreams/verifyTokenForAction.json.php#L30-L56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/Live/view/getRestream.json.php#L27-L48"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/be9d70199279aafe5062744d319fd4df4e5f7a48"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-233c-vfmw-6rw9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-live-restream-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","repo":"https://github.com/WWBN/AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php to retrieve victims' HLS URLs and stream keys, then publish as the victim or restream private or pay-per-view lives."}],"id":"CVE-2026-126541","lastModified":"2026-11-12T20:18:32.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126541","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:09.063825Z","version":"2.0.3"}}]},"published":"2026-11-11T01:17:15.357","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/Live/view/Live_restreams/verifyTokenForAction.json.php#L30-L56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/Live/view/getRestream.json.php#L27-L48"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/be9d70199279aafe5062744d319fd4df4e5f7a48"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-233c-vfmw-6rw9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-live-restream-endpoints"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-233c-vfmw-6rw9"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126544.json b/data/2026/CVE-2026-126544.json index fcfb9ce927..97ae39add1 100644 --- a/data/2026/CVE-2026-126544.json +++ b/data/2026/CVE-2026-126544.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","repo":"https://github.com/WWBN/AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"6.5","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming."}],"id":"CVE-2026-126544","lastModified":"2026-11-11T01:17:16.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T01:17:15.903","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/user.php#L3293-L3307"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/115116813611f2cbabfee3f5d9b49ce6f25ae959"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-f72w-prhp-h385"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-email-verification-bypass-via-user-verifycode"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1024"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","repo":"https://github.com/WWBN/AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"6.5","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming."}],"id":"CVE-2026-126544","lastModified":"2026-11-12T18:17:25.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126544","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:59.204396Z","version":"2.0.3"}}]},"published":"2026-11-11T01:17:15.903","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/user.php#L3293-L3307"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/115116813611f2cbabfee3f5d9b49ce6f25ae959"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-f72w-prhp-h385"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-email-verification-bypass-via-user-verifycode"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1024"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126545.json b/data/2026/CVE-2026-126545.json index 92c8321fbc..a883d5aadd 100644 --- a/data/2026/CVE-2026-126545.json +++ b/data/2026/CVE-2026-126545.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","repo":"https://github.com/WWBN/AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing."}],"id":"CVE-2026-126545","lastModified":"2026-11-11T01:17:16.327","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T01:17:16.120","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/API/API.php#L958-L976"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/VideoTags/Objects/TagsHasVideos.php#L172-L180"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/a8d1e0e484d655556422841d08b2b0fb64332721"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-3w98-8958-84rh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-get-api-tags-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","repo":"https://github.com/WWBN/AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing."}],"id":"CVE-2026-126545","lastModified":"2026-11-12T20:18:32.327","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126545","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:20:40.943041Z","version":"2.0.3"}}]},"published":"2026-11-11T01:17:16.120","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/API/API.php#L958-L976"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/VideoTags/Objects/TagsHasVideos.php#L172-L180"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/a8d1e0e484d655556422841d08b2b0fb64332721"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-3w98-8958-84rh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-get-api-tags-api"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-3w98-8958-84rh"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126560.json b/data/2026/CVE-2026-126560.json index 9626632561..4adaeca0c6 100644 --- a/data/2026/CVE-2026-126560.json +++ b/data/2026/CVE-2026-126560.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter cell attributes, executing script in viewers' browsers including administrators."}],"id":"CVE-2026-126560","lastModified":"2026-11-11T03:16:49.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T03:16:49.987","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/res/smw/printer/ext.smw.tableprinter.js#L349-L357"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/db7f59461a7815416a719b71ce48fb76481ecaf2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-gg2q-rc52-22pp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-stored-xss-via-data-search-attributes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter cell attributes, executing script in viewers' browsers including administrators."}],"id":"CVE-2026-126560","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:02.330841Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:49.987","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/res/smw/printer/ext.smw.tableprinter.js#L349-L357"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/db7f59461a7815416a719b71ce48fb76481ecaf2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-gg2q-rc52-22pp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-stored-xss-via-data-search-attributes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126561.json b/data/2026/CVE-2026-126561.json index 2fa571f57a..47d76bc932 100644 --- a/data/2026/CVE-2026-126561.json +++ b/data/2026/CVE-2026-126561.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"2.5.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the TitleQuickPermissions hook blocks other editors and administrators from editing, moving or deleting them indefinitely."}],"id":"CVE-2026-126561","lastModified":"2026-11-11T03:16:50.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T03:16:50.217","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Protection/ProtectionValidator.php#L293-L311"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/ca81329c74aa64077f367e02ad00c079458ef10a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9w3p-9m8x-j2mw"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.4.1-missing-authorization-via-is-edit-protected-annotation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"2.5.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the TitleQuickPermissions hook blocks other editors and administrators from editing, moving or deleting them indefinitely."}],"id":"CVE-2026-126561","lastModified":"2026-11-12T20:18:32.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126561","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:21:41.431912Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:50.217","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Protection/ProtectionValidator.php#L293-L311"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/ca81329c74aa64077f367e02ad00c079458ef10a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9w3p-9m8x-j2mw"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.4.1-missing-authorization-via-is-edit-protected-annotation"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9w3p-9m8x-j2mw"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126564.json b/data/2026/CVE-2026-126564.json index d015bcea1c..4daf29d543 100644 --- a/data/2026/CVE-2026-126564.json +++ b/data/2026/CVE-2026-126564.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"2.5.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal   as unescaped markup. Users with page-edit rights can set a preferred property label containing an img onerror payload that executes when anyone, including administrators, views Special:Browse or the smwbrowse API."}],"id":"CVE-2026-126564","lastModified":"2026-11-11T03:16:50.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T03:16:50.723","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/MediaWiki/Specials/Browse/ValueFormatter.php#L34-L55"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/c9bf9f25549bb2f5eab916339b267a1732002c4c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-mc5x-2j7v-x8hp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.4.1-stored-xss-via-special-browse-factbox-title"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"2.5.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that renders property label segments after a literal   as unescaped markup. Users with page-edit rights can set a preferred property label containing an img onerror payload that executes when anyone, including administrators, views Special:Browse or the smwbrowse API."}],"id":"CVE-2026-126564","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126564","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:04.953892Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:50.723","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/MediaWiki/Specials/Browse/ValueFormatter.php#L34-L55"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/c9bf9f25549bb2f5eab916339b267a1732002c4c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-mc5x-2j7v-x8hp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.4.1-stored-xss-via-special-browse-factbox-title"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126565.json b/data/2026/CVE-2026-126565.json index 4a522a126e..6973e2e5ec 100644 --- a/data/2026/CVE-2026-126565.json +++ b/data/2026/CVE-2026-126565.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore ConceptDescriptionInterpreter classes, which re-expand concepts without memoization or an expansion budget. Users with page-edit rights can build acyclic chains of Concept: pages that fan out, so queries via concept page views, Special:Ask, or api.php action=ask exhaust CPU and memory."}],"id":"CVE-2026-126565","lastModified":"2026-11-11T03:16:50.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T03:16:50.900","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Elastic/QueryEngine/DescriptionInterpreters/ConceptDescriptionInterpreter.php#L34-L75"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/SPARQLStore/QueryEngine/DescriptionInterpreters/ConceptDescriptionInterpreter.php#L49-L105"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/86ce13254ffd91406ef43ea403ae072a7e3a38b3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-24v2-mf3g-84ch"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-dos-via-exponential-concept-expansion"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore ConceptDescriptionInterpreter classes, which re-expand concepts without memoization or an expansion budget. Users with page-edit rights can build acyclic chains of Concept: pages that fan out, so queries via concept page views, Special:Ask, or api.php action=ask exhaust CPU and memory."}],"id":"CVE-2026-126565","lastModified":"2026-11-12T20:18:32.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126565","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:13:32.790267Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:50.900","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Elastic/QueryEngine/DescriptionInterpreters/ConceptDescriptionInterpreter.php#L34-L75"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/SPARQLStore/QueryEngine/DescriptionInterpreters/ConceptDescriptionInterpreter.php#L49-L105"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/86ce13254ffd91406ef43ea403ae072a7e3a38b3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-24v2-mf3g-84ch"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-dos-via-exponential-concept-expansion"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-24v2-mf3g-84ch"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126569.json b/data/2026/CVE-2026-126569.json index 0fed979133..0efffe38cb 100644 --- a/data/2026/CVE-2026-126569.json +++ b/data/2026/CVE-2026-126569.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/MbinOrg/mbin","product":"mbin","repo":"https://github.com/MbinOrg/mbin","vendor":"MbinOrg","versions":[{"lessThan":"1.11.1","status":"affected","version":"1.2.1","versionType":"semver"},{"status":"unaffected","version":"1.11.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers."}],"id":"CVE-2026-126569","lastModified":"2026-11-11T03:16:51.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T03:16:51.417","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/MbinOrg/mbin/blob/v1.11.0/src/Markdown/CommonMark/EmbedElement.php#L57-L67"},{"source":"disclosure@vulncheck.com","url":"https://github.com/MbinOrg/mbin/commit/736fd39fe9cd59f5d51636d25e1857d88ddbd0bd"},{"source":"disclosure@vulncheck.com","url":"https://github.com/MbinOrg/mbin/releases/tag/v1.11.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/MbinOrg/mbin/security/advisories/GHSA-g3r9-j6w4-2257"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/mbin-1.2.1-before-1.11.1-stored-xss-via-markdown-image-nested-in-link"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/MbinOrg/mbin","product":"mbin","repo":"https://github.com/MbinOrg/mbin","vendor":"MbinOrg","versions":[{"lessThan":"1.11.1","status":"affected","version":"1.2.1","versionType":"semver"},{"status":"unaffected","version":"1.11.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers."}],"id":"CVE-2026-126569","lastModified":"2026-11-12T18:17:26.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126569","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:07.400566Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:51.417","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/MbinOrg/mbin/blob/v1.11.0/src/Markdown/CommonMark/EmbedElement.php#L57-L67"},{"source":"disclosure@vulncheck.com","url":"https://github.com/MbinOrg/mbin/commit/736fd39fe9cd59f5d51636d25e1857d88ddbd0bd"},{"source":"disclosure@vulncheck.com","url":"https://github.com/MbinOrg/mbin/releases/tag/v1.11.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/MbinOrg/mbin/security/advisories/GHSA-g3r9-j6w4-2257"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/mbin-1.2.1-before-1.11.1-stored-xss-via-markdown-image-nested-in-link"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126570.json b/data/2026/CVE-2026-126570.json index 39f3b8c4f0..ad53a39b83 100644 --- a/data/2026/CVE-2026-126570.json +++ b/data/2026/CVE-2026-126570.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/padloc/padloc","product":"padloc","repo":"https://github.com/padloc/padloc","vendor":"padloc","versions":[{"lessThan":"4.3.1","status":"affected","version":"4.0.0","versionType":"semver"},{"status":"unaffected","version":"4.3.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations."}],"id":"CVE-2026-126570","lastModified":"2026-11-11T03:16:51.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T03:16:51.627","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/padloc/padloc/blob/v4.3.0/packages/core/src/util.ts#L239-L251"},{"source":"disclosure@vulncheck.com","url":"https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L421-L428"},{"source":"disclosure@vulncheck.com","url":"https://github.com/padloc/padloc/commit/7dd3d230ef299c71ac215c802600b5f2358f7ba3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/padloc/padloc/security/advisories/GHSA-crhv-mjrg-8vwm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-prototype-pollution-via-scim-patch-setpath"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/padloc/padloc","product":"padloc","repo":"https://github.com/padloc/padloc","vendor":"padloc","versions":[{"lessThan":"4.3.1","status":"affected","version":"4.0.0","versionType":"semver"},{"status":"unaffected","version":"4.3.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer._handleScimUsersPatch(). Attackers can supply paths like __proto__.x or constructor.prototype.x passed to setPath() to pollute the shared server process, disrupting requests for all other organizations."}],"id":"CVE-2026-126570","lastModified":"2026-11-12T20:18:33.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:31:09.518697Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:51.627","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/padloc/padloc/blob/v4.3.0/packages/core/src/util.ts#L239-L251"},{"source":"disclosure@vulncheck.com","url":"https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L421-L428"},{"source":"disclosure@vulncheck.com","url":"https://github.com/padloc/padloc/commit/7dd3d230ef299c71ac215c802600b5f2358f7ba3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/padloc/padloc/security/advisories/GHSA-crhv-mjrg-8vwm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/padloc-4.0.0-before-4.3.1-prototype-pollution-via-scim-patch-setpath"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126607.json b/data/2026/CVE-2026-126607.json index d04f915712..c01e4ec98c 100644 --- a/data/2026/CVE-2026-126607.json +++ b/data/2026/CVE-2026-126607.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.2.3","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins (the plugin folder in the installation's Bin folder) as Latin-1 bytes, which the client reads in the system's ANSI code page when it builds a plugin's path and loads the plugin with LoadLibraryExA, which allows a local authenticated user to execute code as the hMailServer service's account (LocalSystem, or the service's virtual account for a new installation from 6.3.4) by creating the folder those bytes name in the code page and placing in it a DLL with a plugin's name, when the installation folder's path holds a character between U+0080 and U+00FF whose byte the code page reads as another character, and none above U+00FF, and the user can create that other folder (by default any authenticated user may create a folder directly under the root of the system drive). The server converted the path with the C runtime's wcstombs_s in the C locale, which writes each character up to U+00FF as the byte of the same value: on code page 1252 those bytes are the same letters, while on another code page, such as 1251, or on a UTF-8 code page, they name another folder. The client loads the plugin the database server names in its greeting, unless it is built in, and any plugin the server names in an authentication switch, and tries again at each connection while a load fails, so with a MySQL 8.0 or later server, whose greeting names caching_sha2_password by default, the DLL is loaded at the next connection the service makes, whatever plugin the database account uses; a DLL's entry point runs when it is loaded. A path holding any character above U+00FF was handed over as an empty string, whatever the code page, from which the client makes a plugin's name at the root of the current drive: for the service, whose current folder is System32, that is the root of the system drive, where by default only administrators can create a file, but the server's own database commands (hMailServer.exe --check-database, --upgrade-database and the others from 6.3.4, and the /Debug and /Test console modes from 6.2.3) run in the folder they are started from - the product tells administrators to run them from an elevated prompt in the Bin folder, and the setup of 6.3.4 and 6.3.5 ran two or three of them itself with the Bin folder as their working folder for a new installation with an external database - so a DLL that a local authenticated user placed under a plugin's name at the root of a drive other users may write, such as a FAT or exFAT volume, was loaded into the administrator's process at the command's first connection to a MySQL 8.0 or later server. 6.3.8 fixes both cases: it hands the folder in the code page's bytes or by its short (8.3) name, and where neither can be written, a folder under the Windows system folder that holds no plugin and that only administrators can create, or else refuses the connection before attempting it; it never hands the empty value or a folder the current drive completes. The configuration is not the default: the default installation folder, under Program Files, is ASCII. Linux builds set no plugin folder and are not affected."}],"id":"CVE-2026-126607","lastModified":"2026-11-11T09:17:11.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:11.410","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/116"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.2.3","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins (the plugin folder in the installation's Bin folder) as Latin-1 bytes, which the client reads in the system's ANSI code page when it builds a plugin's path and loads the plugin with LoadLibraryExA, which allows a local authenticated user to execute code as the hMailServer service's account (LocalSystem, or the service's virtual account for a new installation from 6.3.4) by creating the folder those bytes name in the code page and placing in it a DLL with a plugin's name, when the installation folder's path holds a character between U+0080 and U+00FF whose byte the code page reads as another character, and none above U+00FF, and the user can create that other folder (by default any authenticated user may create a folder directly under the root of the system drive). The server converted the path with the C runtime's wcstombs_s in the C locale, which writes each character up to U+00FF as the byte of the same value: on code page 1252 those bytes are the same letters, while on another code page, such as 1251, or on a UTF-8 code page, they name another folder. The client loads the plugin the database server names in its greeting, unless it is built in, and any plugin the server names in an authentication switch, and tries again at each connection while a load fails, so with a MySQL 8.0 or later server, whose greeting names caching_sha2_password by default, the DLL is loaded at the next connection the service makes, whatever plugin the database account uses; a DLL's entry point runs when it is loaded. A path holding any character above U+00FF was handed over as an empty string, whatever the code page, from which the client makes a plugin's name at the root of the current drive: for the service, whose current folder is System32, that is the root of the system drive, where by default only administrators can create a file, but the server's own database commands (hMailServer.exe --check-database, --upgrade-database and the others from 6.3.4, and the /Debug and /Test console modes from 6.2.3) run in the folder they are started from - the product tells administrators to run them from an elevated prompt in the Bin folder, and the setup of 6.3.4 and 6.3.5 ran two or three of them itself with the Bin folder as their working folder for a new installation with an external database - so a DLL that a local authenticated user placed under a plugin's name at the root of a drive other users may write, such as a FAT or exFAT volume, was loaded into the administrator's process at the command's first connection to a MySQL 8.0 or later server. 6.3.8 fixes both cases: it hands the folder in the code page's bytes or by its short (8.3) name, and where neither can be written, a folder under the Windows system folder that holds no plugin and that only administrators can create, or else refuses the connection before attempting it; it never hands the empty value or a folder the current drive completes. The configuration is not the default: the default installation folder, under Program Files, is ASCII. Linux builds set no plugin folder and are not affected."}],"id":"CVE-2026-126607","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:11.410","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/116"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126609.json b/data/2026/CVE-2026-126609.json index f9c0aeb3a8..cedd204f6a 100644 --- a/data/2026/CVE-2026-126609.json +++ b/data/2026/CVE-2026-126609.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.2.25","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or verify-full, and a root certificate file named by PostgreSQLSslRootCert (from 6.2.25) or, with TlsMode=verify-full and neither PostgreSQL key set, by TlsCaFile (from 6.3.4), hands the file's name to libpq as bytes in the system's ANSI code page (up to 6.3.5 as Latin-1 bytes, which on code page 1252 are the code page's own for U+00A0 to U+00FF), and libpq looks for the file by those bytes and then hands the same bytes to OpenSSL, whose file opening on Windows reads a name as UTF-8 first and opens the file at that reading when one is there. When every byte of the name outside ASCII also reads as UTF-8 - for example U+00C3 U+00A9, the bytes C3 A9 on code page 1252, which are U+00E9 in UTF-8 - the database server's certificate was checked against the file at that other name whenever one was there, which allows a local attacker who can create that file but cannot change the configured one, as any user can by default beside a file an administrator keeps under ProgramData, or beside a folder directly under the system drive's root whose permissions the administrator restricted, and who can intercept the connection to the database server or stand in for it, to have hMailServer trust a certificate authority of the attacker's own and read and modify the traffic between hMailServer and its database, the database password included; the file alone, holding no authority that issued the database server's certificate, stops hMailServer from connecting to its database. The same applies in 6.3.4 through 6.3.7 to TlsCaFile when an Oracle MySQL client library has been put in place of the bundled MariaDB Connector/C, since that client opens the file through OpenSSL in the same way; the bundled MariaDB Connector/C opens the file in the code page and is not affected, and neither are the Linux builds. The configuration is not the default: by default no root certificate file is named."}],"id":"CVE-2026-126609","lastModified":"2026-11-11T09:17:12.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:12.687","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/114"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.2.25","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or verify-full, and a root certificate file named by PostgreSQLSslRootCert (from 6.2.25) or, with TlsMode=verify-full and neither PostgreSQL key set, by TlsCaFile (from 6.3.4), hands the file's name to libpq as bytes in the system's ANSI code page (up to 6.3.5 as Latin-1 bytes, which on code page 1252 are the code page's own for U+00A0 to U+00FF), and libpq looks for the file by those bytes and then hands the same bytes to OpenSSL, whose file opening on Windows reads a name as UTF-8 first and opens the file at that reading when one is there. When every byte of the name outside ASCII also reads as UTF-8 - for example U+00C3 U+00A9, the bytes C3 A9 on code page 1252, which are U+00E9 in UTF-8 - the database server's certificate was checked against the file at that other name whenever one was there, which allows a local attacker who can create that file but cannot change the configured one, as any user can by default beside a file an administrator keeps under ProgramData, or beside a folder directly under the system drive's root whose permissions the administrator restricted, and who can intercept the connection to the database server or stand in for it, to have hMailServer trust a certificate authority of the attacker's own and read and modify the traffic between hMailServer and its database, the database password included; the file alone, holding no authority that issued the database server's certificate, stops hMailServer from connecting to its database. The same applies in 6.3.4 through 6.3.7 to TlsCaFile when an Oracle MySQL client library has been put in place of the bundled MariaDB Connector/C, since that client opens the file through OpenSSL in the same way; the bundled MariaDB Connector/C opens the file in the code page and is not affected, and neither are the Linux builds. The configuration is not the default: by default no root certificate file is named."}],"id":"CVE-2026-126609","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:12.687","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/114"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126610.json b/data/2026/CVE-2026-126610.json index 9ba4513513..680052f8b6 100644 --- a/data/2026/CVE-2026-126610.json +++ b/data/2026/CVE-2026-126610.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.4","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not hand the database client the CA file that TlsCaFile names when the file's name contains a character outside ASCII on Linux, or above U+00FF on Windows, which allows an attacker who can intercept the connection to the database server to read and modify the traffic between hMailServer and its database, by presenting, with MariaDB Connector/C 3.4.2 to 3.4.10 as the client, a certificate from any authority, its own included, for any name, and otherwise a certificate for the database server's name issued by any certificate authority in the system's trust store. The server converted the name for the client with the C runtime's conversion in the C locale, which gives an empty string for such a name, and then set no CA file at all, without an error, while certificate verification stayed on, so the client - MariaDB Connector/C, bundled on Windows and the distribution's on Linux - verified the certificate of a database server over the network against the system's trust store instead of the configured CA; Connector/C 3.4.2 to 3.4.10 (bundled on Windows in 6.3.4 to 6.3.6) went further and, with no CA file, took a certificate within its dates whose issuer it could not find, for any name, with neither its chain nor its name checked and no password proof, when the server offered first a sign-in method that hashes the password, which an attacker in the middle chooses (MariaDB's CONC-853, fixed in Connector/C 3.4.11), and Connector/C 3.4 accepted from a MariaDB 11.4 or later server a certificate the store did not vouch for when that server proved it held the account's password; on a connection it treats as local (127.0.0.1, ::1, a Unix socket, a named pipe, and localhost on Windows), Connector/C 3.4.1 and later checked neither the certificate's issuer nor its name, so that a local attacker able to stand in for the database server could present any certificate within its dates of its own making. The settings line of hmailserver --check-database still named the configured file, and the application log said the certificate had been checked. With MariaDB Connector/C 3.4.1 to 3.4.9 as the client - bundled on Windows in 6.3.4 to 6.3.6, and the client of Linux distributions that have not patched it - the missing CA file also met the precondition of CVE-2026-107819, so that a certificate issued for any other name by a trusted authority was enough to obtain the database password. On Linux the file was found only when the server ran on glibc under a locale whose character set holds the name's characters (a UTF-8 locale, or a legacy 8-bit one the system has, in whose bytes the file is then named); with no locale, LC_ALL=C or a locale the system lacks, and on Alpine (musl), the connection failed instead. The configuration is not the default: TlsMode defaults to prefer, which checks no certificate."}],"id":"CVE-2026-126610","lastModified":"2026-11-11T09:17:12.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:12.830","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/112"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.4","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not hand the database client the CA file that TlsCaFile names when the file's name contains a character outside ASCII on Linux, or above U+00FF on Windows, which allows an attacker who can intercept the connection to the database server to read and modify the traffic between hMailServer and its database, by presenting, with MariaDB Connector/C 3.4.2 to 3.4.10 as the client, a certificate from any authority, its own included, for any name, and otherwise a certificate for the database server's name issued by any certificate authority in the system's trust store. The server converted the name for the client with the C runtime's conversion in the C locale, which gives an empty string for such a name, and then set no CA file at all, without an error, while certificate verification stayed on, so the client - MariaDB Connector/C, bundled on Windows and the distribution's on Linux - verified the certificate of a database server over the network against the system's trust store instead of the configured CA; Connector/C 3.4.2 to 3.4.10 (bundled on Windows in 6.3.4 to 6.3.6) went further and, with no CA file, took a certificate within its dates whose issuer it could not find, for any name, with neither its chain nor its name checked and no password proof, when the server offered first a sign-in method that hashes the password, which an attacker in the middle chooses (MariaDB's CONC-853, fixed in Connector/C 3.4.11), and Connector/C 3.4 accepted from a MariaDB 11.4 or later server a certificate the store did not vouch for when that server proved it held the account's password; on a connection it treats as local (127.0.0.1, ::1, a Unix socket, a named pipe, and localhost on Windows), Connector/C 3.4.1 and later checked neither the certificate's issuer nor its name, so that a local attacker able to stand in for the database server could present any certificate within its dates of its own making. The settings line of hmailserver --check-database still named the configured file, and the application log said the certificate had been checked. With MariaDB Connector/C 3.4.1 to 3.4.9 as the client - bundled on Windows in 6.3.4 to 6.3.6, and the client of Linux distributions that have not patched it - the missing CA file also met the precondition of CVE-2026-107819, so that a certificate issued for any other name by a trusted authority was enough to obtain the database password. On Linux the file was found only when the server ran on glibc under a locale whose character set holds the name's characters (a UTF-8 locale, or a legacy 8-bit one the system has, in whose bytes the file is then named); with no locale, LC_ALL=C or a locale the system lacks, and on Alpine (musl), the connection failed instead. The configuration is not the default: TlsMode defaults to prefer, which checks no certificate."}],"id":"CVE-2026-126610","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:12.830","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/112"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126611.json b/data/2026/CVE-2026-126611.json index b112034276..b9b9397026 100644 --- a/data/2026/CVE-2026-126611.json +++ b/data/2026/CVE-2026-126611.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.4","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify the database server's certificate's issuer or name when the connection is one that MariaDB Connector/C treats as local - Server= set to 127.0.0.1, ::1 or localhost (on Linux a Unix socket), to . on Windows (a named pipe), or to a comma-separated list of servers that holds such an element - which allows a local attacker who can stand in for the database server, for example by listening on its port while it is stopped or restarting, to receive the database sign-in, the password included, and to read and modify the traffic between hMailServer and its database. hMailServer applied verify-full by turning the client's certificate verification on without a CA file, but MariaDB Connector/C 3.4.1 and later, on a connection they treat as local and with no CA file, accept any certificate within its validity period that is self-signed or sent with its own root, for any name (Connector/C 3.4.2 to 3.4.10 also one whose issuer they cannot find), so the client accepted the certificate an impostor made, asked no proof of the password and allowed a switch to an authentication method that sends the password unhashed, while hmailserver --check-database said the certificate had been checked against the system's trust store and the application log that it had been checked. The Windows builds bundle Connector/C 3.4.9 (6.3.4 to 6.3.6) and 3.4.11 (6.3.7); on Linux the distribution's client is used, and Connector/C 3.3 and 3.4.0 and Oracle's MySQL client are not affected. The configuration is not the default: TlsMode defaults to prefer, which checks no certificate."}],"id":"CVE-2026-126611","lastModified":"2026-11-11T09:17:12.973","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:12.973","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/113"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.4","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify the database server's certificate's issuer or name when the connection is one that MariaDB Connector/C treats as local - Server= set to 127.0.0.1, ::1 or localhost (on Linux a Unix socket), to . on Windows (a named pipe), or to a comma-separated list of servers that holds such an element - which allows a local attacker who can stand in for the database server, for example by listening on its port while it is stopped or restarting, to receive the database sign-in, the password included, and to read and modify the traffic between hMailServer and its database. hMailServer applied verify-full by turning the client's certificate verification on without a CA file, but MariaDB Connector/C 3.4.1 and later, on a connection they treat as local and with no CA file, accept any certificate within its validity period that is self-signed or sent with its own root, for any name (Connector/C 3.4.2 to 3.4.10 also one whose issuer they cannot find), so the client accepted the certificate an impostor made, asked no proof of the password and allowed a switch to an authentication method that sends the password unhashed, while hmailserver --check-database said the certificate had been checked against the system's trust store and the application log that it had been checked. The Windows builds bundle Connector/C 3.4.9 (6.3.4 to 6.3.6) and 3.4.11 (6.3.7); on Linux the distribution's client is used, and Connector/C 3.3 and 3.4.0 and Oracle's MySQL client are not affected. The configuration is not the default: TlsMode defaults to prefer, which checks no certificate."}],"id":"CVE-2026-126611","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:12.973","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/113"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126612.json b/data/2026/CVE-2026-126612.json index 5e85b5b07e..bdb6b6c683 100644 --- a/data/2026/CVE-2026-126612.json +++ b/data/2026/CVE-2026-126612.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.0.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected."}],"id":"CVE-2026-126612","lastModified":"2026-11-11T09:17:13.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.110","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/78"},{"source":"cve@gitlab.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-107571"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.0.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected."}],"id":"CVE-2026-126612","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.110","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/78"},{"source":"cve@gitlab.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-107571"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126613.json b/data/2026/CVE-2026-126613.json index 8f18d397b0..17dc80968b 100644 --- a/data/2026/CVE-2026-126613.json +++ b/data/2026/CVE-2026-126613.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.2","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API and the webmail unavailable. The reader built a tree of values far larger than the text it read, copying each value into every level above it, and set no bound on the number of values, so a single JSON document of many small values, within the 16 MB the server reads, raised the service's memory by about 2 GB and held one thread for seconds to minutes. From 6.3.4 a remote unauthenticated attacker reaches the reader by mailing such a document as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound. From 6.3.4 it is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account, from 6.3.2 through the webmail's send and draft routes and from 6.3.4 through its other routes granted 16 MB and the send API; the webmail's send, draft and settings routes parsed the body again for each member read. The REST API serves every request on four worker threads, in the process that also serves SMTP, IMAP and POP3, so a few such documents at once make it unavailable and can exhaust the machine's memory and end the whole service. This is a separate defect from CVE-2026-107574, the reader's handling of duplicate member names, fixed in 6.3.6."}],"id":"CVE-2026-126613","lastModified":"2026-11-11T09:17:13.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.267","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/110"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.2","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API and the webmail unavailable. The reader built a tree of values far larger than the text it read, copying each value into every level above it, and set no bound on the number of values, so a single JSON document of many small values, within the 16 MB the server reads, raised the service's memory by about 2 GB and held one thread for seconds to minutes. From 6.3.4 a remote unauthenticated attacker reaches the reader by mailing such a document as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound. From 6.3.4 it is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account, from 6.3.2 through the webmail's send and draft routes and from 6.3.4 through its other routes granted 16 MB and the send API; the webmail's send, draft and settings routes parsed the body again for each member read. The REST API serves every request on four worker threads, in the process that also serves SMTP, IMAP and POP3, so a few such documents at once make it unavailable and can exhaust the machine's memory and end the whole service. This is a separate defect from CVE-2026-107574, the reader's handling of duplicate member names, fixed in 6.3.6."}],"id":"CVE-2026-126613","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.267","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/110"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126614.json b/data/2026/CVE-2026-126614.json index 7bdf27a44d..5af5915fd5 100644 --- a/data/2026/CVE-2026-126614.json +++ b/data/2026/CVE-2026-126614.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.3","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it accepts, which allows a remote unauthenticated attacker to go on guessing account passwords at the listener's sign-ins after the auto-ban has banned the attacker's address. The listener is off by default (WebServicesHttpPort and WebServicesHttpsPort 0). From 6.3.3 its CardDAV, and from 6.3.4 its CalDAV and its Outlook Autodiscover answer to a request that carries credentials, sign an account in with HTTP Basic over HTTPS. A failed sign-in there counts towards the auto-ban as a failed logon on any other protocol does: when the failures counted from one address reach MaxInvalidLogonAttempts (3 within 30 minutes by default), the server writes an IP range that refuses the address for AutoBanMinutes (60 by default), and the SMTP, POP3, IMAP and ManageSieve listeners refuse it. The web services listener asked no IP range when it accepted a connection (in 6.3.3 nothing, from 6.3.4 the country policy alone), so it went on serving such an address, whether its ban had been earned there or on another protocol, and also an address that an administrator's IP range allowing nothing holds. Each failed sign-in there closed only its own connection, and the next connection was accepted, during the ban and after it. The firewall rule and command the auto-ban can drive (AutoBanFirewall and AutoBanCommand, off by default) are told only the SMTP, POP3 and IMAP ports, so that the firewall rule and the packaged hook did not close the listener's ports, and the fail2ban jail packaged for Linux (off by default) lists only the mail and ManageSieve ports. The only limit left on the guesses at one account there was the per-name lockout (AccountLockoutThreshold in hMailServer.ini, 0, off, by default), which has a separate defect fixed in the same release. The flaw is reached on the listener's HTTPS port: behind a TLS-terminating proxy the listener sees the proxy's address for every client, and a ban never named the client there."}],"id":"CVE-2026-126614","lastModified":"2026-11-11T09:17:13.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.423","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/105"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.3","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it accepts, which allows a remote unauthenticated attacker to go on guessing account passwords at the listener's sign-ins after the auto-ban has banned the attacker's address. The listener is off by default (WebServicesHttpPort and WebServicesHttpsPort 0). From 6.3.3 its CardDAV, and from 6.3.4 its CalDAV and its Outlook Autodiscover answer to a request that carries credentials, sign an account in with HTTP Basic over HTTPS. A failed sign-in there counts towards the auto-ban as a failed logon on any other protocol does: when the failures counted from one address reach MaxInvalidLogonAttempts (3 within 30 minutes by default), the server writes an IP range that refuses the address for AutoBanMinutes (60 by default), and the SMTP, POP3, IMAP and ManageSieve listeners refuse it. The web services listener asked no IP range when it accepted a connection (in 6.3.3 nothing, from 6.3.4 the country policy alone), so it went on serving such an address, whether its ban had been earned there or on another protocol, and also an address that an administrator's IP range allowing nothing holds. Each failed sign-in there closed only its own connection, and the next connection was accepted, during the ban and after it. The firewall rule and command the auto-ban can drive (AutoBanFirewall and AutoBanCommand, off by default) are told only the SMTP, POP3 and IMAP ports, so that the firewall rule and the packaged hook did not close the listener's ports, and the fail2ban jail packaged for Linux (off by default) lists only the mail and ManageSieve ports. The only limit left on the guesses at one account there was the per-name lockout (AccountLockoutThreshold in hMailServer.ini, 0, off, by default), which has a separate defect fixed in the same release. The flaw is reached on the listener's HTTPS port: behind a TLS-terminating proxy the listener sees the proxy's address for every client, and a ban never named the client there."}],"id":"CVE-2026-126614","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.423","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/105"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126615.json b/data/2026/CVE-2026-126615.json index a977261870..3d8ea97bdb 100644 --- a/data/2026/CVE-2026-126615.json +++ b/data/2026/CVE-2026-126615.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.2.22-pre2","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The sign-in of Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7 takes for an account names that are not its address but under which the database's own comparison finds it, while the per-name lockout and the compromised-account hold are kept by the name as the client gave it. This allows a remote unauthenticated attacker to go on guessing an account's password beyond the lockout's threshold, and anyone who has the password of an account held for review to sign in to it. The per-name lockout (from 6.2.22-pre2; AccountLockoutThreshold in hMailServer.ini, 0, off, by default) locks a name after repeated failed sign-ins. The hold (from 6.3.4, where the compromised-account detection is set to enforce, which is not the default) refuses an account judged to have been taken over. Both are asked, before the password, of the name the client gave: trimmed, in lower case and with a domain alias or the default domain applied. The account whose password the sign-in then checks is whichever one the database finds under that name. The databases find an account under spellings that this key counts apart. MySQL and MariaDB find it under one with accented letters in place of plain ones, and MariaDB 11.8, in a database made before 6.3.4, also under one with full-width letters, with a single letter in place of a pair of plain ones, or with characters its comparison ignores in any number. SQL Server and SQL Server Compact find it under one with full-width letters or with characters their comparison ignores in any number, and SQL Server also under one with a single letter in place of a pair of plain ones, with a character of Latin-1 in place of a digit and, for an address holding letters of Latin-1 outside ASCII, under those letters in the other case, and, under an accent-insensitive collation, with accented letters. PostgreSQL finds it under one holding a letter whose lower case under the database's locale is a plain letter, and, for an address holding letters outside ASCII, under those letters in the other case; on the build for musl (from 6.3.6) the server's own lower case folds nearly all of these too. On every database, a domain alias saved with white space at the end of its name gives such a spelling too, and on every database but PostgreSQL so does an account's bare local part where the default domain was saved with spaces at its end and no other white space (neither is the default). Each such spelling has a lockout threshold of its own, so the lockout limits the guesses at an account only to its threshold times the number of the account's spellings. That is far beyond any threshold for most addresses on MySQL and MariaDB, and without limit on SQL Server, on SQL Server Compact, the database the Windows installer uses by default, and before 6.3.4 on MariaDB 11.8. A locked name is got round under another spelling. A held account is signed in to under another spelling with its password over IMAP, POP3 and SMTP AUTH, and, where they are turned on (off by default), over ManageSieve, the REST API and the webmail. IMAP LOGIN, offered as installed, carries such spellings on MySQL, MariaDB and SQL Server Compact, and, on SQL Server and PostgreSQL, for some addresses; the sign-ins that carry a name as UTF-8 carry them for the others on SQL Server, and on PostgreSQL for those holding one of the plain letters another letter lowers to or a letter outside ASCII with another case. The same lookup mapped to accounts the names given by an OAuth 2.0 token, a client certificate, a Kerberos ticket and an OpenID Connect or SAML identity provider, where those are set up (none is by default), so that a name an issuer gave to one party could sign in to another's account; OAuth 2.0 tokens were mapped so from 6.2.0, before the per-name lockout existed. A name holding a NUL character, carried from 6.3.0 on Linux and 6.3.3 on Windows, failed the statement on MySQL, MariaDB and PostgreSQL."}],"id":"CVE-2026-126615","lastModified":"2026-11-11T09:17:13.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.573","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/104"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-289"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.2.22-pre2","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The sign-in of Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7 takes for an account names that are not its address but under which the database's own comparison finds it, while the per-name lockout and the compromised-account hold are kept by the name as the client gave it. This allows a remote unauthenticated attacker to go on guessing an account's password beyond the lockout's threshold, and anyone who has the password of an account held for review to sign in to it. The per-name lockout (from 6.2.22-pre2; AccountLockoutThreshold in hMailServer.ini, 0, off, by default) locks a name after repeated failed sign-ins. The hold (from 6.3.4, where the compromised-account detection is set to enforce, which is not the default) refuses an account judged to have been taken over. Both are asked, before the password, of the name the client gave: trimmed, in lower case and with a domain alias or the default domain applied. The account whose password the sign-in then checks is whichever one the database finds under that name. The databases find an account under spellings that this key counts apart. MySQL and MariaDB find it under one with accented letters in place of plain ones, and MariaDB 11.8, in a database made before 6.3.4, also under one with full-width letters, with a single letter in place of a pair of plain ones, or with characters its comparison ignores in any number. SQL Server and SQL Server Compact find it under one with full-width letters or with characters their comparison ignores in any number, and SQL Server also under one with a single letter in place of a pair of plain ones, with a character of Latin-1 in place of a digit and, for an address holding letters of Latin-1 outside ASCII, under those letters in the other case, and, under an accent-insensitive collation, with accented letters. PostgreSQL finds it under one holding a letter whose lower case under the database's locale is a plain letter, and, for an address holding letters outside ASCII, under those letters in the other case; on the build for musl (from 6.3.6) the server's own lower case folds nearly all of these too. On every database, a domain alias saved with white space at the end of its name gives such a spelling too, and on every database but PostgreSQL so does an account's bare local part where the default domain was saved with spaces at its end and no other white space (neither is the default). Each such spelling has a lockout threshold of its own, so the lockout limits the guesses at an account only to its threshold times the number of the account's spellings. That is far beyond any threshold for most addresses on MySQL and MariaDB, and without limit on SQL Server, on SQL Server Compact, the database the Windows installer uses by default, and before 6.3.4 on MariaDB 11.8. A locked name is got round under another spelling. A held account is signed in to under another spelling with its password over IMAP, POP3 and SMTP AUTH, and, where they are turned on (off by default), over ManageSieve, the REST API and the webmail. IMAP LOGIN, offered as installed, carries such spellings on MySQL, MariaDB and SQL Server Compact, and, on SQL Server and PostgreSQL, for some addresses; the sign-ins that carry a name as UTF-8 carry them for the others on SQL Server, and on PostgreSQL for those holding one of the plain letters another letter lowers to or a letter outside ASCII with another case. The same lookup mapped to accounts the names given by an OAuth 2.0 token, a client certificate, a Kerberos ticket and an OpenID Connect or SAML identity provider, where those are set up (none is by default), so that a name an issuer gave to one party could sign in to another's account; OAuth 2.0 tokens were mapped so from 6.2.0, before the per-name lockout existed. A name holding a NUL character, carried from 6.3.0 on Linux and 6.3.3 on Windows, failed the statement on MySQL, MariaDB and PostgreSQL."}],"id":"CVE-2026-126615","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.573","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/104"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-289"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126616.json b/data/2026/CVE-2026-126616.json index 2e4b737c92..3c30ac86a0 100644 --- a/data/2026/CVE-2026-126616.json +++ b/data/2026/CVE-2026-126616.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.3","status":"affected","version":"6.2.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker to go on guessing account passwords from a single address without being banned. The server makes its MySQL tables in MySQL's utf8 character set, which holds no character outside the Basic Multilingual Plane, sends its statements as UTF-8 over a utf8mb4 connection and leaves the database's default strict mode in place. From 6.2.0 it decodes the user name of a SASL PLAIN logon as UTF-8, so the name can hold such a character. When the failed logons counted from one address reach MaxInvalidLogonAttempts (3 by default), the server clears that address's count, saves an IP range named \"Auto-ban: \" followed by the user name of the logon that reached the limit, and drops the connection. If such a character is in the part of the user name that the range's name keeps (the name is cut to 100 characters), the database refuses the range: no range is saved, the address is not refused, and, its count having already been cleared, it is given the next full set of attempts. An attacker can in this way spend all but the last attempt of each set on password guesses, and make the last under such a name. On Windows, POP3 AUTH PLAIN reaches it on a server as installed, and IMAP AUTHENTICATE PLAIN where IMAP SASL authentication is turned on (off by default); on Windows and on Linux (from 6.3.0), SMTP AUTH PLAIN reaches it where plain-text authentication is allowed (off by default), and ManageSieve and CardDAV where they are turned on (off by default). Each failed save is reported in the server's error log. A database whose strict mode has been turned off stores the character as a question mark and makes the first such ban, but refuses every later ban named after the same user name, or after one holding other such characters in their place, as a duplicate while the first stands, since the server cannot look up a name holding such a character there."}],"id":"CVE-2026-126616","lastModified":"2026-11-11T09:17:13.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.713","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.4"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/103"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.3","status":"affected","version":"6.2.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker to go on guessing account passwords from a single address without being banned. The server makes its MySQL tables in MySQL's utf8 character set, which holds no character outside the Basic Multilingual Plane, sends its statements as UTF-8 over a utf8mb4 connection and leaves the database's default strict mode in place. From 6.2.0 it decodes the user name of a SASL PLAIN logon as UTF-8, so the name can hold such a character. When the failed logons counted from one address reach MaxInvalidLogonAttempts (3 by default), the server clears that address's count, saves an IP range named \"Auto-ban: \" followed by the user name of the logon that reached the limit, and drops the connection. If such a character is in the part of the user name that the range's name keeps (the name is cut to 100 characters), the database refuses the range: no range is saved, the address is not refused, and, its count having already been cleared, it is given the next full set of attempts. An attacker can in this way spend all but the last attempt of each set on password guesses, and make the last under such a name. On Windows, POP3 AUTH PLAIN reaches it on a server as installed, and IMAP AUTHENTICATE PLAIN where IMAP SASL authentication is turned on (off by default); on Windows and on Linux (from 6.3.0), SMTP AUTH PLAIN reaches it where plain-text authentication is allowed (off by default), and ManageSieve and CardDAV where they are turned on (off by default). Each failed save is reported in the server's error log. A database whose strict mode has been turned off stores the character as a question mark and makes the first such ban, but refuses every later ban named after the same user name, or after one holding other such characters in their place, as a duplicate while the first stands, since the server cannot look up a name holding such a character there."}],"id":"CVE-2026-126616","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.713","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.4"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/103"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126617.json b/data/2026/CVE-2026-126617.json index b0f99063a7..cc8fb8389b 100644 --- a/data/2026/CVE-2026-126617.json +++ b/data/2026/CVE-2026-126617.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.2.18","status":"affected","version":"6.0.0-B1","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSQL, allows a remote attacker to alter SQL statements the server runs. On those two engines parameters are not bound: SQLStatement::GenerateFromCommand wrote each value into the statement's text as a quoted literal with a separate string replacement over the whole text per parameter, so a value holding the name of a parameter substituted after it had that name replaced, inside the value, by the later value with its own quotes, which ended the literal early and placed the later value in the statement as SQL. The row the server writes for each recipient of a queued message carries the recipient's address twice, so in the default configuration an authenticated user who may send mail reaches it by sending to an address of their choosing. A remote unauthenticated sender reaches the same statement through a message the server sends to the envelope sender, such as a delivery failure notice or an automatic reply, and, when greylisting or message indexing is enabled (both are off by default), through the greylisting record's envelope addresses or through the message metadata the server stores for IMAP SORT, which carries four header fields of a received message. An altered statement runs with the privileges of the server's database account; on PostgreSQL, whose client call runs every statement in the text it is given, further statements can follow it, while on MySQL/MariaDB, where one statement is run per call, the change is confined to the statement it is in. SQL Server and SQL Server Compact, where parameters are bound, are not affected."}],"id":"CVE-2026-126617","lastModified":"2026-11-11T09:17:13.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.860","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.2.19"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/101"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.2.18","status":"affected","version":"6.0.0-B1","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSQL, allows a remote attacker to alter SQL statements the server runs. On those two engines parameters are not bound: SQLStatement::GenerateFromCommand wrote each value into the statement's text as a quoted literal with a separate string replacement over the whole text per parameter, so a value holding the name of a parameter substituted after it had that name replaced, inside the value, by the later value with its own quotes, which ended the literal early and placed the later value in the statement as SQL. The row the server writes for each recipient of a queued message carries the recipient's address twice, so in the default configuration an authenticated user who may send mail reaches it by sending to an address of their choosing. A remote unauthenticated sender reaches the same statement through a message the server sends to the envelope sender, such as a delivery failure notice or an automatic reply, and, when greylisting or message indexing is enabled (both are off by default), through the greylisting record's envelope addresses or through the message metadata the server stores for IMAP SORT, which carries four header fields of a received message. An altered statement runs with the privileges of the server's database account; on PostgreSQL, whose client call runs every statement in the text it is given, further statements can follow it, while on MySQL/MariaDB, where one statement is run per call, the change is confined to the statement it is in. SQL Server and SQL Server Compact, where parameters are bound, are not affected."}],"id":"CVE-2026-126617","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:13.860","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.2.19"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/101"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126618.json b/data/2026/CVE-2026-126618.json index 841f6d9488..117e7a1ff3 100644 --- a/data/2026/CVE-2026-126618.json +++ b/data/2026/CVE-2026-126618.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.0.0-B1","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker who can connect from two or more addresses to go on guessing account passwords - over SMTP AUTH, IMAP and POP3, and over ManageSieve, CalDAV/CardDAV and the REST API where those are turned on (off by default) - without being banned. When the failed logons counted from one address reach MaxInvalidLogonAttempts (3 by default), the server clears that address's count, saves an IP range that refuses the address for AutoBanMinutes (60 by default) and drops the connection. The range is named \"Auto-ban: \" followed by the user name of the logon that reached the limit, and no two ranges may have the same name. The server chooses the name by checking candidates as written - the name, then the name with a number, a random suffix or a GUID added - and only then cuts it to the 100 characters the database column holds, so that with a user name of 90 characters or more every candidate is the same once cut. While one range named after such a user name stands, every later ban named after a user name with the same first 90 characters therefore fails at the database: no range is saved, the address is not refused, and, its count having already been cleared, it is given the next full set of attempts. A user name of 78 to 89 characters makes later bans fail in the same way: from the second, the third or the twelfth on, depending on its length and the database, or, from 78 to 85 characters, by chance. An attacker who has once had an address banned under such a name can in this way keep guessing passwords from any other address, ending each set of attempts with a logon under a name of that kind; each failed save is reported in the server's error log (as the database error HM5032, and from 6.2.19 also as HM6099). On SQL Server a user name holding characters outside the database's code page has the same effect at any length, because the check compared names in that code page; that save is refused by the server's own check of the name, with no database error, and is reported only from 6.2.19 (HM6099). A user name holding a NUL character, which the web services listener's HTTP Basic sign-in (off by default) carries from 6.3.3 and, on the Linux builds, IMAP LOGIN, offered as installed, from 6.3.0, makes bans fail at any length: on MySQL, MariaDB and PostgreSQL the statements that check the name and save the range end at the character, so that every ban named after such a name fails, from the first and from a single address, and, its count having already been cleared, the address is given the next full set of attempts; on SQL Server and SQL Server Compact the name is bound only as far as the character, so that while one range under the part before it stands, every later ban named after such a name fails. On SQL Server, and on MySQL and MariaDB for an account whose local part has nine characters or more, a guess at the account can itself carry a name of that kind, since those databases find an account under its address followed by spaces (and SQL Server also under one holding characters its comparison ignores), so that not even a MaxInvalidLogonAttempts of 1, which bans each failed logon under the name it gave, avoids it there."}],"id":"CVE-2026-126618","lastModified":"2026-11-11T09:17:14.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.000","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/102"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.0.0-B1","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker who can connect from two or more addresses to go on guessing account passwords - over SMTP AUTH, IMAP and POP3, and over ManageSieve, CalDAV/CardDAV and the REST API where those are turned on (off by default) - without being banned. When the failed logons counted from one address reach MaxInvalidLogonAttempts (3 by default), the server clears that address's count, saves an IP range that refuses the address for AutoBanMinutes (60 by default) and drops the connection. The range is named \"Auto-ban: \" followed by the user name of the logon that reached the limit, and no two ranges may have the same name. The server chooses the name by checking candidates as written - the name, then the name with a number, a random suffix or a GUID added - and only then cuts it to the 100 characters the database column holds, so that with a user name of 90 characters or more every candidate is the same once cut. While one range named after such a user name stands, every later ban named after a user name with the same first 90 characters therefore fails at the database: no range is saved, the address is not refused, and, its count having already been cleared, it is given the next full set of attempts. A user name of 78 to 89 characters makes later bans fail in the same way: from the second, the third or the twelfth on, depending on its length and the database, or, from 78 to 85 characters, by chance. An attacker who has once had an address banned under such a name can in this way keep guessing passwords from any other address, ending each set of attempts with a logon under a name of that kind; each failed save is reported in the server's error log (as the database error HM5032, and from 6.2.19 also as HM6099). On SQL Server a user name holding characters outside the database's code page has the same effect at any length, because the check compared names in that code page; that save is refused by the server's own check of the name, with no database error, and is reported only from 6.2.19 (HM6099). A user name holding a NUL character, which the web services listener's HTTP Basic sign-in (off by default) carries from 6.3.3 and, on the Linux builds, IMAP LOGIN, offered as installed, from 6.3.0, makes bans fail at any length: on MySQL, MariaDB and PostgreSQL the statements that check the name and save the range end at the character, so that every ban named after such a name fails, from the first and from a single address, and, its count having already been cleared, the address is given the next full set of attempts; on SQL Server and SQL Server Compact the name is bound only as far as the character, so that while one range under the part before it stands, every later ban named after such a name fails. On SQL Server, and on MySQL and MariaDB for an account whose local part has nine characters or more, a guess at the account can itself carry a name of that kind, since those databases find an account under its address followed by spaces (and SQL Server also under one holding characters its comparison ignores), so that not even a MaxInvalidLogonAttempts of 1, which bans each failed logon under the name it gave, avoids it there."}],"id":"CVE-2026-126618","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.000","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/102"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126619.json b/data/2026/CVE-2026-126619.json index 9538dc9bee..45fdd3bb9c 100644 --- a/data/2026/CVE-2026-126619.json +++ b/data/2026/CVE-2026-126619.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.0.0-B1","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the marker [IGNORE-ERRORS], which is meant only for the server's own schema statements (its upgrade scripts and the database log's tables), and statements carry values from outside - an envelope address, the user name of a failed logon, a message's headers - in their text on MySQL/MariaDB and PostgreSQL, and in the batches of the database log on every engine. Up to 6.2.18 the marker was honoured anywhere in a statement, a value included, on MySQL/MariaDB and PostgreSQL. From 6.2.19 it was honoured only inside a comment, but the layer read a backslash inside a string literal as an escape, which SQL Server, SQL Server Compact and PostgreSQL with standard_conforming_strings on (its default) do not, so that on those engines a value holding a backslash could make the layer take part of the statement's literals for statement text and find the marker there: on PostgreSQL from 6.3.3 for every statement carrying an outside value that holds a backslash, with no setting changed for a message delivered into a local mailbox (through an internationalised (SMTPUTF8) envelope sender) and for the IP range an auto-ban writes (named after the user name of the failed logon), and on SQL Server and SQL Server Compact for the database log, when the server logs to the database (logging is off, and the log device is files, by default). A statement run outside a transaction that then failed - a constraint, a deadlock, a lock or statement timeout, a full disk, and up to 6.2.18 a lost connection - was answered as a success, and its caller went on as if the row had been written: a message delivered into a local mailbox could be counted as delivered with no row to show it and no failure notice to its sender, and a message accepted with 250 could be left with no queue row and never delivered (up to 6.2.18, and on PostgreSQL from 6.3.3 when every recipient's address carries the marker too, which needs an address that takes any local part); an auto-ban whose IP range was not written could be logged and counted as applied, with no error reported, while the address stayed unbanned; and message metadata (written only when message indexing is on), entries of the database log and rows of features an administrator turns on could be lost without an error. On MySQL/MariaDB up to 6.2.18 the caller was handed whatever identifier the client library still held for the connection - 0, or that of an insert its last successful statement made, in whatever table - under which a queued message's recipients were then written, so that another message still in the queue could be delivered to them as well. This flaw gives a value no way to change what a statement does, and no privilege is gained."}],"id":"CVE-2026-126619","lastModified":"2026-11-11T09:17:14.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.133","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/100"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-115"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.0.0-B1","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the marker [IGNORE-ERRORS], which is meant only for the server's own schema statements (its upgrade scripts and the database log's tables), and statements carry values from outside - an envelope address, the user name of a failed logon, a message's headers - in their text on MySQL/MariaDB and PostgreSQL, and in the batches of the database log on every engine. Up to 6.2.18 the marker was honoured anywhere in a statement, a value included, on MySQL/MariaDB and PostgreSQL. From 6.2.19 it was honoured only inside a comment, but the layer read a backslash inside a string literal as an escape, which SQL Server, SQL Server Compact and PostgreSQL with standard_conforming_strings on (its default) do not, so that on those engines a value holding a backslash could make the layer take part of the statement's literals for statement text and find the marker there: on PostgreSQL from 6.3.3 for every statement carrying an outside value that holds a backslash, with no setting changed for a message delivered into a local mailbox (through an internationalised (SMTPUTF8) envelope sender) and for the IP range an auto-ban writes (named after the user name of the failed logon), and on SQL Server and SQL Server Compact for the database log, when the server logs to the database (logging is off, and the log device is files, by default). A statement run outside a transaction that then failed - a constraint, a deadlock, a lock or statement timeout, a full disk, and up to 6.2.18 a lost connection - was answered as a success, and its caller went on as if the row had been written: a message delivered into a local mailbox could be counted as delivered with no row to show it and no failure notice to its sender, and a message accepted with 250 could be left with no queue row and never delivered (up to 6.2.18, and on PostgreSQL from 6.3.3 when every recipient's address carries the marker too, which needs an address that takes any local part); an auto-ban whose IP range was not written could be logged and counted as applied, with no error reported, while the address stayed unbanned; and message metadata (written only when message indexing is on), entries of the database log and rows of features an administrator turns on could be lost without an error. On MySQL/MariaDB up to 6.2.18 the caller was handed whatever identifier the client library still held for the connection - 0, or that of an insert its last successful statement made, in whatever table - under which a queued message's recipients were then written, so that another message still in the queue could be delivered to them as well. This flaw gives a value no way to change what a statement does, and no privilege is gained."}],"id":"CVE-2026-126619","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.133","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/100"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-115"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126621.json b/data/2026/CVE-2026-126621.json index 27d4af1365..53c5824799 100644 --- a/data/2026/CVE-2026-126621.json +++ b/data/2026/CVE-2026-126621.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.0.0-B1","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Windows hands OpenSSL the names of its own TLS files - the listeners' certificates, chains, private keys and Diffie-Hellman parameters, a port's client-certificate CA file (from 6.2.19), the object store's CA file (from 6.3.4) and the ACME client's keys and certificates - as Latin-1 bytes, which on code page 1252 are the code page's own for U+00A0 to U+00FF, and OpenSSL's file opening on Windows reads a name as UTF-8 first and opens the file at that reading when it is there, or creates it there when its folder is. When every byte of a configured name outside ASCII also reads as UTF-8 - for example U+00C3 U+00A9, the bytes C3 A9, which are U+00E9 in UTF-8 - the server used the file at that other name whenever one was there, which allows a local attacker who can create that file or its folder but cannot change the configured one, as any user can by default beside a file an administrator keeps under ProgramData, to have a port that logs on by client certificate (from 6.2.25) accept certificates from a certificate authority of the attacker's own and so sign in over the network as any mailbox without its password; to have the server trust such an authority for its object store and, intercepting that connection, read and modify the messages it stores; to receive the private keys the ACME client writes, the key of a certificate issued for the server's names among them; or to keep TLS ports from starting. The configuration is not the default: by default these files have names in ASCII, client certificates are off on every port, and the object store and ACME are off. The Linux builds are not affected."}],"id":"CVE-2026-126621","lastModified":"2026-11-11T09:17:14.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.277","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/115"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.0.0-B1","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Windows hands OpenSSL the names of its own TLS files - the listeners' certificates, chains, private keys and Diffie-Hellman parameters, a port's client-certificate CA file (from 6.2.19), the object store's CA file (from 6.3.4) and the ACME client's keys and certificates - as Latin-1 bytes, which on code page 1252 are the code page's own for U+00A0 to U+00FF, and OpenSSL's file opening on Windows reads a name as UTF-8 first and opens the file at that reading when it is there, or creates it there when its folder is. When every byte of a configured name outside ASCII also reads as UTF-8 - for example U+00C3 U+00A9, the bytes C3 A9, which are U+00E9 in UTF-8 - the server used the file at that other name whenever one was there, which allows a local attacker who can create that file or its folder but cannot change the configured one, as any user can by default beside a file an administrator keeps under ProgramData, to have a port that logs on by client certificate (from 6.2.25) accept certificates from a certificate authority of the attacker's own and so sign in over the network as any mailbox without its password; to have the server trust such an authority for its object store and, intercepting that connection, read and modify the messages it stores; to receive the private keys the ACME client writes, the key of a certificate issued for the server's names among them; or to keep TLS ports from starting. The configuration is not the default: by default these files have names in ASCII, client certificates are off on every port, and the object store and ACME are off. The Linux builds are not affected."}],"id":"CVE-2026-126621","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.277","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/115"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126622.json b/data/2026/CVE-2026-126622.json index 1439e4a602..86b744c32f 100644 --- a/data/2026/CVE-2026-126622.json +++ b/data/2026/CVE-2026-126622.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"status":"affected","version":"6.3.7"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the server is installed into a program folder that is already there and that accounts other than the administrators could write, such as a folder made beforehand at the root of a drive, or when such an installation is upgraded or repaired. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but for a folder that is already there it does so only at the end of setup: setup first copies the programs into Bin, which every user may still write, and runs programs from Bin with the administrator's elevated rights, registering the service among them, before that hardening, so that a library another account places in Bin meanwhile is loaded in place of the system's. A handle an account opened on such a folder while it could write it keeps that access after the hardening. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected."}],"id":"CVE-2026-126622","lastModified":"2026-11-11T09:17:14.413","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.413","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/78"},{"source":"cve@gitlab.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-107571"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"status":"affected","version":"6.3.7"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the server is installed into a program folder that is already there and that accounts other than the administrators could write, such as a folder made beforehand at the root of a drive, or when such an installation is upgraded or repaired. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but for a folder that is already there it does so only at the end of setup: setup first copies the programs into Bin, which every user may still write, and runs programs from Bin with the administrator's elevated rights, registering the service among them, before that hardening, so that a library another account places in Bin meanwhile is loaded in place of the system's. A handle an account opened on such a folder while it could write it keeps that access after the hardening. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected."}],"id":"CVE-2026-126622","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.413","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/78"},{"source":"cve@gitlab.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-107571"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126623.json b/data/2026/CVE-2026-126623.json index 36d7a4a51f..7b8eedebc7 100644 --- a/data/2026/CVE-2026-126623.json +++ b/data/2026/CVE-2026-126623.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.6","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the server's mail delivery threads or its REST API's worker threads, making mail delivery, the REST API and the webmail unavailable. 6.3.6 fixed CVE-2026-107574, in which reading a JSON object searched the member names already read for each new name, by keeping the names in a hash set; the set uses the standard library's hash, which takes no secret, so member names chosen to fall in one bucket of it still cost time growing with the square of their number. Against the released reader, one such object of 16 MB took about 5 seconds to read in the Linux build, and one of under 6 MB about 23 seconds in the Windows build, where objects of the same sizes with other names took under a tenth of a second. A remote unauthenticated attacker reaches the reader by mailing such an object as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound, so a stream of such reports stops all delivery for as long as it continues. It is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account through the webmail's routes granted 16 MB, and by an application's API key through the send API. Each such request holds one of the REST API's four worker threads, in the process that also serves SMTP, IMAP and POP3."}],"id":"CVE-2026-126623","lastModified":"2026-11-11T09:17:14.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.550","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/111"},{"source":"cve@gitlab.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-107574"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.6","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the server's mail delivery threads or its REST API's worker threads, making mail delivery, the REST API and the webmail unavailable. 6.3.6 fixed CVE-2026-107574, in which reading a JSON object searched the member names already read for each new name, by keeping the names in a hash set; the set uses the standard library's hash, which takes no secret, so member names chosen to fall in one bucket of it still cost time growing with the square of their number. Against the released reader, one such object of 16 MB took about 5 seconds to read in the Linux build, and one of under 6 MB about 23 seconds in the Windows build, where objects of the same sizes with other names took under a tenth of a second. A remote unauthenticated attacker reaches the reader by mailing such an object as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound, so a stream of such reports stops all delivery for as long as it continues. It is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account through the webmail's routes granted 16 MB, and by an application's API key through the send API. Each such request holds one of the REST API's four worker threads, in the process that also serves SMTP, IMAP and POP3."}],"id":"CVE-2026-126623","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.550","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/111"},{"source":"cve@gitlab.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-107574"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126624.json b/data/2026/CVE-2026-126624.json index 027cf16fe3..768316b069 100644 --- a/data/2026/CVE-2026-126624.json +++ b/data/2026/CVE-2026-126624.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"status":"affected","version":"6.3.7"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unverified ownership in the Windows installer of Progressive Robot hMailServer 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when setup installs into, or upgrades, a program folder that accounts other than the administrators could write before, such as one made beforehand at the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but setup refused nothing that was already in them, or in the folders that hold the event script, the add-ons and the database scripts: a program, a library, a script or a settings file that another account owns, or whose own permissions let another account change it, is kept with that owner and those permissions, which the hardening of the folders does not take away. Setup then runs programs from Bin with the administrator's elevated rights, and the service, which runs as LocalSystem or as its virtual account, runs them and the event script, so that a library such an account placed in Bin is loaded in place of the system's; the account can still change the file after the installation. The default installation under Program Files is not affected."}],"id":"CVE-2026-126624","lastModified":"2026-11-11T09:17:14.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.690","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/78"},{"source":"cve@gitlab.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-107571"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-283"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"status":"affected","version":"6.3.7"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unverified ownership in the Windows installer of Progressive Robot hMailServer 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when setup installs into, or upgrades, a program folder that accounts other than the administrators could write before, such as one made beforehand at the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but setup refused nothing that was already in them, or in the folders that hold the event script, the add-ons and the database scripts: a program, a library, a script or a settings file that another account owns, or whose own permissions let another account change it, is kept with that owner and those permissions, which the hardening of the folders does not take away. Setup then runs programs from Bin with the administrator's elevated rights, and the service, which runs as LocalSystem or as its virtual account, runs them and the event script, so that a library such an account placed in Bin is loaded in place of the system's; the account can still change the file after the installation. The default installation under Program Files is not affected."}],"id":"CVE-2026-126624","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.690","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/78"},{"source":"cve@gitlab.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-107571"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-283"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126625.json b/data/2026/CVE-2026-126625.json index 397f13d65b..e63a8706a6 100644 --- a/data/2026/CVE-2026-126625.json +++ b/data/2026/CVE-2026-126625.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"status":"affected","version":"6.3.7"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who installs the product, when it is installed into a new program folder in a location whose permissions let every user write, such as the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but its setup lets Inno Setup make a new program folder first, with the permissions the folder above hands down, and replaces them only afterwards, tens of milliseconds later (33 to 139 milliseconds in the project's test runs). In that time any local account may make files and folders in the new folder, which keep that account as their owner, among them the Bin folder that setup then copies the programs into. Setup runs programs from Bin with the administrator's elevated rights, registering the service among them, before its hardening at the end of setup takes such a folder back, and those programs load a library placed in Bin in place of the system's. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected."}],"id":"CVE-2026-126625","lastModified":"2026-11-11T09:17:14.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.833","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/78"},{"source":"cve@gitlab.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-107571"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"status":"affected","version":"6.3.7"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who installs the product, when it is installed into a new program folder in a location whose permissions let every user write, such as the root of a drive. 6.3.7 fixed CVE-2026-107571 by giving the program folder, Bin and ControlPanel permissions that only administrators may change, but its setup lets Inno Setup make a new program folder first, with the permissions the folder above hands down, and replaces them only afterwards, tens of milliseconds later (33 to 139 milliseconds in the project's test runs). In that time any local account may make files and folders in the new folder, which keep that account as their owner, among them the Bin folder that setup then copies the programs into. Setup runs programs from Bin with the administrator's elevated rights, registering the service among them, before its hardening at the end of setup takes such a folder back, and those programs load a library placed in Bin in place of the system's. The default installation under Program Files, whose folders give ordinary users read and execute only, is not affected."}],"id":"CVE-2026-126625","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.833","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/78"},{"source":"cve@gitlab.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-107571"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126626.json b/data/2026/CVE-2026-126626.json index 796ba61cf5..b22fe8fbe4 100644 --- a/data/2026/CVE-2026-126626.json +++ b/data/2026/CVE-2026-126626.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.3","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 counts every failed CardDAV, CalDAV or Autodiscover sign-in from a proxy it trusts - one on the same machine, or one named in WebServicesTrustedProxies, whose X-Forwarded-Proto it believes - against the proxy's own address, which allows a remote unauthenticated attacker who can reach the proxy to have that address banned from the server's mail listeners. The listener, off by default (WebServicesHttpPort and WebServicesHttpsPort 0), signs an account in with HTTP Basic over HTTPS for CardDAV from 6.3.3 and for CalDAV and Outlook Autodiscover from 6.3.4. Behind a TLS-terminating proxy, which the server trusts when it is on the same machine or named in WebServicesTrustedProxies, the listener takes the client's HTTPS from the proxy's X-Forwarded-Proto header, but it does not believe X-Forwarded-For and sees the proxy's address for every client. Each failed sign-in counted towards the auto-ban against that address, so that failed sign-ins through the proxy from anybody, under any user name, reaching MaxInvalidLogonAttempts (3 within 30 minutes by default) wrote an IP range that refused the proxy's address at the SMTP, POP3, IMAP and ManageSieve listeners for AutoBanMinutes (60 by default), and could write it again each time it lapsed. For a proxy on the same machine that address is the loopback address, so that a webmail on that machine, local scripts that submit mail and the other local clients of the mail listeners were shut out; for a proxy at another address that also carries mail, every mail client behind it was. Such a proxy forwarding to the listener's HTTPS port, re-encrypting, was counted against in the same way, and listing it in WebServicesTrustedProxies did not spare it. The auto-ban is on by default and AutoBanNeverBan, which spares an address, is empty by default; the listener itself went on serving the proxy."}],"id":"CVE-2026-126626","lastModified":"2026-11-11T09:17:14.973","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.973","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/106"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-645"}],"source":"cve@gitlab.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"hMailServer","repo":"https://gitlab.com/hmailserver/hmailserver","vendor":"Progressive Robot Ltd","versions":[{"lessThanOrEqual":"6.3.7","status":"affected","version":"6.3.3","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 counts every failed CardDAV, CalDAV or Autodiscover sign-in from a proxy it trusts - one on the same machine, or one named in WebServicesTrustedProxies, whose X-Forwarded-Proto it believes - against the proxy's own address, which allows a remote unauthenticated attacker who can reach the proxy to have that address banned from the server's mail listeners. The listener, off by default (WebServicesHttpPort and WebServicesHttpsPort 0), signs an account in with HTTP Basic over HTTPS for CardDAV from 6.3.3 and for CalDAV and Outlook Autodiscover from 6.3.4. Behind a TLS-terminating proxy, which the server trusts when it is on the same machine or named in WebServicesTrustedProxies, the listener takes the client's HTTPS from the proxy's X-Forwarded-Proto header, but it does not believe X-Forwarded-For and sees the proxy's address for every client. Each failed sign-in counted towards the auto-ban against that address, so that failed sign-ins through the proxy from anybody, under any user name, reaching MaxInvalidLogonAttempts (3 within 30 minutes by default) wrote an IP range that refused the proxy's address at the SMTP, POP3, IMAP and ManageSieve listeners for AutoBanMinutes (60 by default), and could write it again each time it lapsed. For a proxy on the same machine that address is the loopback address, so that a webmail on that machine, local scripts that submit mail and the other local clients of the mail listeners were shut out; for a proxy at another address that also carries mail, every mail client behind it was. Such a proxy forwarding to the listener's HTTPS port, re-encrypting, was counted against in the same way, and listing it in WebServicesTrustedProxies did not spare it. The auto-ban is on by default and AutoBanNeverBan, which spares an address, is empty by default; the listener itself went on serving the proxy."}],"id":"CVE-2026-126626","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-11T09:17:14.973","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8"},{"source":"cve@gitlab.com","url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/106"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-645"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126627.json b/data/2026/CVE-2026-126627.json index 67f59c94e9..88ff0c4c5a 100644 --- a/data/2026/CVE-2026-126627.json +++ b/data/2026/CVE-2026-126627.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:fop-core","packageURL":"pkg:maven/org.apache.xmlgraphics/fop-core","product":"Apache XML Graphics FOP","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.11.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue."}],"id":"CVE-2026-126627","lastModified":"2026-11-11T19:17:36.727","metrics":{},"published":"2026-11-11T12:19:51.030","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/FOP-3284"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/f8mys56y18wjmp1wzg4qmx6hhyjxgo0f"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/15"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-378"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:fop-core","packageURL":"pkg:maven/org.apache.xmlgraphics/fop-core","product":"Apache XML Graphics FOP","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.11.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue."}],"id":"CVE-2026-126627","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-11T12:19:51.030","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/FOP-3284"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/f8mys56y18wjmp1wzg4qmx6hhyjxgo0f"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/15"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-378"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126642.json b/data/2026/CVE-2026-126642.json index ccdf1217c1..65bf42ea1b 100644 --- a/data/2026/CVE-2026-126642.json +++ b/data/2026/CVE-2026-126642.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-24/controller-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/controller-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/controller-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/controller-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"automation-controller","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential use_role when assigning the single-valued webhook_credential foreign key: JobTemplateAccess.can_add/can_change and WorkflowJobTemplateAccess.can_change in awx/main/access.py omit the check_related('webhook_credential', Credential, ..., role_field='use_role') call that UnifiedCredentialsMixin.can_attach performs for the normal many-to-many credentials relationship, and the serializer validates only the credential's type and namespace. A user who may administer their own job template (or workflow job template) and use its project and inventory can therefore attach a webhook token credential (for example a GitLab token) that they do not have use permission on. The template administrator can retrieve the template's webhook key; a subsequent webhook event causes AWX to decrypt the attached token and send it in the request header (for GitLab, PRIVATE-TOKEN) to a status URL derived from the event payload, disclosing the victim's token to a destination the attacker can influence. This may disclose another user's personal access token and allow whatever actions that token permits."}],"id":"CVE-2026-126642","lastModified":"2026-11-12T09:16:40.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T09:16:40.020","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-126642"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571729"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-24/controller-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/controller-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/controller-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/controller-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"automation-controller","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Credential use_role when assigning the single-valued webhook_credential foreign key: JobTemplateAccess.can_add/can_change and WorkflowJobTemplateAccess.can_change in awx/main/access.py omit the check_related('webhook_credential', Credential, ..., role_field='use_role') call that UnifiedCredentialsMixin.can_attach performs for the normal many-to-many credentials relationship, and the serializer validates only the credential's type and namespace. A user who may administer their own job template (or workflow job template) and use its project and inventory can therefore attach a webhook token credential (for example a GitLab token) that they do not have use permission on. The template administrator can retrieve the template's webhook key; a subsequent webhook event causes AWX to decrypt the attached token and send it in the request header (for GitLab, PRIVATE-TOKEN) to a status URL derived from the event payload, disclosing the victim's token to a destination the attacker can influence. This may disclose another user's personal access token and allow whatever actions that token permits."}],"id":"CVE-2026-126642","lastModified":"2026-11-12T18:17:26.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126642","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:37.458229Z","version":"2.0.3"}}]},"published":"2026-11-12T09:16:40.020","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-126642"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571729"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126659.json b/data/2026/CVE-2026-126659.json index 2dab42adc9..50e4721923 100644 --- a/data/2026/CVE-2026-126659.json +++ b/data/2026/CVE-2026-126659.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/blueprintue/blueprintue-self-hosted-edition","product":"blueprintue-self-hosted-edition","repo":"https://github.com/blueprintue/blueprintue-self-hosted-edition","vendor":"blueprintue","versions":[{"lessThan":"4.3.5","status":"affected","version":"1.0.0","versionType":"semver"},{"status":"unaffected","version":"4.3.5","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a 'never' expiration, bypassing purges to fill the disk and deny service."}],"id":"CVE-2026-126659","lastModified":"2026-11-11T13:17:24.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T13:17:24.167","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.4/app/controllers/www/HomeController.php#L151-L214"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/0709b39851bf58febccf0bc74b88fa86070410de"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/268"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-q2vm-p36g-w596"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-1.0.0-before-4.3.5-storage-exhaustion-via-anonymous-blueprints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/blueprintue/blueprintue-self-hosted-edition","product":"blueprintue-self-hosted-edition","repo":"https://github.com/blueprintue/blueprintue-self-hosted-edition","vendor":"blueprintue","versions":[{"lessThan":"4.3.5","status":"affected","version":"1.0.0","versionType":"semver"},{"status":"unaffected","version":"4.3.5","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a 'never' expiration, bypassing purges to fill the disk and deny service."}],"id":"CVE-2026-126659","lastModified":"2026-11-12T18:17:26.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126659","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:03.368574Z","version":"2.0.3"}}]},"published":"2026-11-11T13:17:24.167","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.4/app/controllers/www/HomeController.php#L151-L214"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/0709b39851bf58febccf0bc74b88fa86070410de"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/268"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-q2vm-p36g-w596"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-1.0.0-before-4.3.5-storage-exhaustion-via-anonymous-blueprints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126662.json b/data/2026/CVE-2026-126662.json index 07a836f144..bc1448af90 100644 --- a/data/2026/CVE-2026-126662.json +++ b/data/2026/CVE-2026-126662.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/contao/core-bundle","product":"Contao","repo":"https://github.com/contao/contao","vendor":"Contao","versions":[{"lessThan":"5.3.54","status":"affected","version":"4.0.0","versionType":"semver"},{"lessThan":"5.7.17","status":"affected","version":"5.4.0-RC1","versionType":"semver"},{"lessThan":"6.0.6","status":"affected","version":"6.0.0-RC1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download."}],"id":"CVE-2026-126662","lastModified":"2026-11-11T13:17:24.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T13:17:24.337","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folder.php#L1716-L1720"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/5.3.54"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/5.7.17"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/6.0.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiple"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/contao/core-bundle","product":"Contao","repo":"https://github.com/contao/contao","vendor":"Contao","versions":[{"lessThan":"5.3.54","status":"affected","version":"4.0.0","versionType":"semver"},{"lessThan":"5.7.17","status":"affected","version":"5.4.0-RC1","versionType":"semver"},{"lessThan":"6.0.6","status":"affected","version":"6.0.0-RC1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download."}],"id":"CVE-2026-126662","lastModified":"2026-11-12T20:18:33.327","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126662","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:34:37.731994Z","version":"2.0.3"}}]},"published":"2026-11-11T13:17:24.337","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/drivers/DC_Folder.php#L1716-L1720"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/240e169441796bb703819ee0e22728708f946b70"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/a104202df2b532bb64805a0856fc94bb0bddbb66"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/c01898f99c5d5af50a227ee85f27270c5427f900"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/5.3.54"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/5.7.17"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/6.0.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/security/advisories/GHSA-9jfh-v443-w3fj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/contao-4.0.0-before-5.3.54-5.4.0-before-5.7.17-and-6.0.0-before-6.0.6-filemount-bypass-via-edit-multiple"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126673.json b/data/2026/CVE-2026-126673.json index 1ac899e109..e52ebb5efd 100644 --- a/data/2026/CVE-2026-126673.json +++ b/data/2026/CVE-2026-126673.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Data::Dump::Streamer"],"packageName":"Data-Dump-Streamer","packageURL":"pkg:cpan/Data-Dump-Streamer","programFiles":["lib/Data/Dump/Streamer.pm"],"programRoutines":[{"name":"Data::Dump::Streamer::_dump_qr"}],"repo":"https://github.com/demerphq/Data-Dump-Streamer","versions":[{"lessThan":"3.00","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.\n\nA Regexp's pattern is written into a qr literal without escaping \"$\" or \"@\", so \"@{[ ... ]}\" and \"${\\ ... }\" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.\n\nAn attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code."}],"id":"CVE-2026-126673","lastModified":"2026-11-12T06:17:14.380","metrics":{},"published":"2026-11-12T01:17:11.457","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/YVES/Data-Dump-Streamer-3.00/source/Changes"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/12/2"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Data::Dump::Streamer"],"packageName":"Data-Dump-Streamer","packageURL":"pkg:cpan/Data-Dump-Streamer","programFiles":["lib/Data/Dump/Streamer.pm"],"programRoutines":[{"name":"Data::Dump::Streamer::_dump_qr"}],"repo":"https://github.com/demerphq/Data-Dump-Streamer","versions":[{"lessThan":"3.00","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.\n\nA Regexp's pattern is written into a qr literal without escaping \"$\" or \"@\", so \"@{[ ... ]}\" and \"${\\ ... }\" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.\n\nAn attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code."}],"id":"CVE-2026-126673","lastModified":"2026-11-12T20:07:11.090","metrics":{},"published":"2026-11-12T01:17:11.457","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/YVES/Data-Dump-Streamer-3.00/source/Changes"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/12/2"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126720.json b/data/2026/CVE-2026-126720.json index cf279ed47f..a1e06b9906 100644 --- a/data/2026/CVE-2026-126720.json +++ b/data/2026/CVE-2026-126720.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Rooxis RXR-12","vendor":"Rooxis","versions":[{"status":"affected","version":"0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813_c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface."}],"id":"CVE-2026-126720","lastModified":"2026-11-11T17:17:18.663","metrics":{},"published":"2026-11-11T17:17:18.663","references":[{"source":"cret@cert.org","url":"https://lab.geodesy.phd/writeups/rooxis-router/"},{"source":"cret@cert.org","url":"https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"Rooxis RXR-12","vendor":"Rooxis","versions":[{"status":"affected","version":"0"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813_c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface."}],"id":"CVE-2026-126720","lastModified":"2026-11-12T19:22:01.433","metrics":{},"published":"2026-11-11T17:17:18.663","references":[{"source":"cret@cert.org","url":"https://lab.geodesy.phd/writeups/rooxis-router/"},{"source":"cret@cert.org","url":"https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-126722.json b/data/2026/CVE-2026-126722.json index 29661aca65..cc35f4ed45 100644 --- a/data/2026/CVE-2026-126722.json +++ b/data/2026/CVE-2026-126722.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Rooxis RXR-12","vendor":"Rooxis","versions":[{"lessThan":"20260813_c2169ea5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide static key and IV, enables telnet service with default credentials, providing remote root access. Firmware 20260813_c2169ea5 removes the UDP listener entirely, and users can update through their local web interface."}],"id":"CVE-2026-126722","lastModified":"2026-11-11T17:17:18.793","metrics":{},"published":"2026-11-11T17:17:18.793","references":[{"source":"cret@cert.org","url":"https://lab.geodesy.phd/writeups/rooxis-router/"},{"source":"cret@cert.org","url":"https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"Rooxis RXR-12","vendor":"Rooxis","versions":[{"lessThan":"20260813_c2169ea5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide static key and IV, enables telnet service with default credentials, providing remote root access. Firmware 20260813_c2169ea5 removes the UDP listener entirely, and users can update through their local web interface."}],"id":"CVE-2026-126722","lastModified":"2026-11-12T19:22:01.433","metrics":{},"published":"2026-11-11T17:17:18.793","references":[{"source":"cret@cert.org","url":"https://lab.geodesy.phd/writeups/rooxis-router/"},{"source":"cret@cert.org","url":"https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-126723.json b/data/2026/CVE-2026-126723.json index 06754ba842..bace07e5c3 100644 --- a/data/2026/CVE-2026-126723.json +++ b/data/2026/CVE-2026-126723.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Rooxis RXR-12","vendor":"Rooxis","versions":[{"lessThan":"20260813_c2169ea5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface."}],"id":"CVE-2026-126723","lastModified":"2026-11-11T17:17:18.907","metrics":{},"published":"2026-11-11T17:17:18.907","references":[{"source":"cret@cert.org","url":"https://lab.geodesy.phd/writeups/rooxis-router/"},{"source":"cret@cert.org","url":"https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"Rooxis RXR-12","vendor":"Rooxis","versions":[{"lessThan":"20260813_c2169ea5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface."}],"id":"CVE-2026-126723","lastModified":"2026-11-12T19:22:01.433","metrics":{},"published":"2026-11-11T17:17:18.907","references":[{"source":"cret@cert.org","url":"https://lab.geodesy.phd/writeups/rooxis-router/"},{"source":"cret@cert.org","url":"https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-126724.json b/data/2026/CVE-2026-126724.json index 4925badeb2..81d012563d 100644 --- a/data/2026/CVE-2026-126724.json +++ b/data/2026/CVE-2026-126724.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Rooxis RXR-12","vendor":"Rooxis","versions":[{"lessThan":"20260813_c2169ea5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813_c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface."}],"id":"CVE-2026-126724","lastModified":"2026-11-11T17:17:19.053","metrics":{},"published":"2026-11-11T17:17:19.053","references":[{"source":"cret@cert.org","url":"https://lab.geodesy.phd/writeups/rooxis-router/"},{"source":"cret@cert.org","url":"https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"Rooxis RXR-12","vendor":"Rooxis","versions":[{"lessThan":"20260813_c2169ea5","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813_c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface."}],"id":"CVE-2026-126724","lastModified":"2026-11-12T19:22:01.433","metrics":{},"published":"2026-11-11T17:17:19.053","references":[{"source":"cret@cert.org","url":"https://lab.geodesy.phd/writeups/rooxis-router/"},{"source":"cret@cert.org","url":"https://rooxis.com/firmware/SOP-ramips-mt7621-DGR7-ROOXIS-local-debug.bin"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-126759.json b/data/2026/CVE-2026-126759.json index 14b5628acf..90a3b63778 100644 --- a/data/2026/CVE-2026-126759.json +++ b/data/2026/CVE-2026-126759.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:h3c:icg2000_unified_communication_gateway:*:*:*:*:*:*:*:*"],"modules":["Web Management Module"],"product":"ICG2000 Unified Communication Gateway","vendor":"H3C","versions":[{"status":"affected","version":"2023"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in H3C ICG2000 Unified Communication Gateway 2023. This issue affects some unknown processing of the file /wnm/check.j of the component Web Management Module. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. The researcher claims that the vendor has acknowledged receipt of the vulnerability report. No further response has been received."}],"id":"CVE-2026-126759","lastModified":"2026-11-12T00:17:14.823","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-12T00:17:14.527","references":[{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-126759"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1035822"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/435869"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/435869/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:h3c:icg2000_unified_communication_gateway:*:*:*:*:*:*:*:*"],"modules":["Web Management Module"],"product":"ICG2000 Unified Communication Gateway","vendor":"H3C","versions":[{"status":"affected","version":"2023"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in H3C ICG2000 Unified Communication Gateway 2023. This issue affects some unknown processing of the file /wnm/check.j of the component Web Management Module. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. The researcher claims that the vendor has acknowledged receipt of the vulnerability report. No further response has been received."}],"id":"CVE-2026-126759","lastModified":"2026-11-12T18:17:26.923","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126759","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:18.063054Z","version":"2.0.3"}}]},"published":"2026-11-12T00:17:14.527","references":[{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-126759"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1035822"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/435869"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/435869/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126767.json b/data/2026/CVE-2026-126767.json index 64d38a7650..3c812d9405 100644 --- a/data/2026/CVE-2026-126767.json +++ b/data/2026/CVE-2026-126767.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"REMS","vendor":"OpsTree Solutions","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks."}],"id":"CVE-2026-126767","lastModified":"2026-11-11T19:17:37.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:37.007","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/548bfde3e45bc3793f3f26e1f9a43efe"},{"source":"disclosure@vulncheck.com","url":"https://opstree.com/rems-ai-powered-observability/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-prompt-injection-via-rca-chat-assistant"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"REMS","vendor":"OpsTree Solutions","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks."}],"id":"CVE-2026-126767","lastModified":"2026-11-12T18:17:27.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126767","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:55:27.199740Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:37.007","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/548bfde3e45bc3793f3f26e1f9a43efe"},{"source":"disclosure@vulncheck.com","url":"https://opstree.com/rems-ai-powered-observability/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-prompt-injection-via-rca-chat-assistant"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received"} diff --git a/data/2026/CVE-2026-126768.json b/data/2026/CVE-2026-126768.json index 56cee8b113..eabc340c7b 100644 --- a/data/2026/CVE-2026-126768.json +++ b/data/2026/CVE-2026-126768.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"REMS","vendor":"OpsTree Solutions","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access."}],"id":"CVE-2026-126768","lastModified":"2026-11-11T19:17:37.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:37.140","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46"},{"source":"disclosure@vulncheck.com","url":"https://opstree.com/rems-ai-powered-observability/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-authentication-bypass-via-is-local-auth-flag"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"REMS","vendor":"OpsTree Solutions","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access."}],"id":"CVE-2026-126768","lastModified":"2026-11-12T20:18:33.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126768","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:39:28.906885Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:37.140","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/4676fe10859d84900025cf52188dae46"},{"source":"disclosure@vulncheck.com","url":"https://opstree.com/rems-ai-powered-observability/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-authentication-bypass-via-is-local-auth-flag"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126771.json b/data/2026/CVE-2026-126771.json index 7d7a02fba3..e4a923ae4a 100644 --- a/data/2026/CVE-2026-126771.json +++ b/data/2026/CVE-2026-126771.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"REMS","vendor":"OpsTree Solutions","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers."}],"id":"CVE-2026-126771","lastModified":"2026-11-11T19:17:37.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:37.600","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/ddf75e2cb7192180e6c9618d27d1e99b"},{"source":"disclosure@vulncheck.com","url":"https://opstree.com/rems-ai-powered-observability/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-stored-xss-via-attachment-upload-and-preview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"REMS","vendor":"OpsTree Solutions","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers."}],"id":"CVE-2026-126771","lastModified":"2026-11-12T18:17:27.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126771","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:55:30.614790Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:37.600","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/ddf75e2cb7192180e6c9618d27d1e99b"},{"source":"disclosure@vulncheck.com","url":"https://opstree.com/rems-ai-powered-observability/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-stored-xss-via-attachment-upload-and-preview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126774.json b/data/2026/CVE-2026-126774.json index 94d57a3952..2789b96093 100644 --- a/data/2026/CVE-2026-126774.json +++ b/data/2026/CVE-2026-126774.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://www.npmjs.com","defaultStatus":"unaffected","packageURL":"pkg:npm/%40tinacms/mdx","product":"@tinacms/mdx","repo":"https://github.com/tinacms/tinacms","vendor":"tinacms","versions":[{"lessThan":"2.4.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.4.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts."}],"id":"CVE-2026-126774","lastModified":"2026-11-11T19:17:37.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:37.937","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tinacms/tinacms/blob/%40tinacms/mdx%400.60.3/packages/%40tinacms/mdx/src/stringify/acorn.ts#L81"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinacms/tinacms/commit/19285c6deeee52c380e8b2fdeafedc9530dc0618"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinacms/tinacms/pull/7958"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinacms/tinacms/releases/tag/%40tinacms/mdx%402.4.2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-6vw5-w22x-ghxv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tinacms-mdx-before-2.4.2-code-injection-via-mdx-serializer-rich-text-values"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://www.npmjs.com","defaultStatus":"unaffected","packageURL":"pkg:npm/%40tinacms/mdx","product":"@tinacms/mdx","repo":"https://github.com/tinacms/tinacms","vendor":"tinacms","versions":[{"lessThan":"2.4.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.4.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts."}],"id":"CVE-2026-126774","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:37.937","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tinacms/tinacms/blob/%40tinacms/mdx%400.60.3/packages/%40tinacms/mdx/src/stringify/acorn.ts#L81"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinacms/tinacms/commit/19285c6deeee52c380e8b2fdeafedc9530dc0618"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinacms/tinacms/pull/7958"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinacms/tinacms/releases/tag/%40tinacms/mdx%402.4.2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-6vw5-w22x-ghxv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tinacms-mdx-before-2.4.2-code-injection-via-mdx-serializer-rich-text-values"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126775.json b/data/2026/CVE-2026-126775.json index 8bc56dc7aa..8468804fed 100644 --- a/data/2026/CVE-2026-126775.json +++ b/data/2026/CVE-2026-126775.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org","defaultStatus":"unaffected","packageURL":"pkg:pypi/social-auth-core","product":"social-auth-core","repo":"https://github.com/python-social-auth/social-core","vendor":"python-social-auth","versions":[{"lessThan":"7.0.0","status":"affected","version":"4.7.0","versionType":"semver"},{"status":"unaffected","version":"7.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data."}],"id":"CVE-2026-126775","lastModified":"2026-11-11T19:17:38.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:38.110","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/commit/7d9da571fc9ce8bd0003ccfcbfa8ed98c18bb640"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/pull/2167"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/releases/tag/7.0.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-4pv2-52v7-vrfx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/social-auth-core-4.7.0-before-7.0.0-login-csrf-via-saml-relaystate"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org","defaultStatus":"unaffected","packageURL":"pkg:pypi/social-auth-core","product":"social-auth-core","repo":"https://github.com/python-social-auth/social-core","vendor":"python-social-auth","versions":[{"lessThan":"7.0.0","status":"affected","version":"4.7.0","versionType":"semver"},{"status":"unaffected","version":"7.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data."}],"id":"CVE-2026-126775","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:38.110","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/commit/7d9da571fc9ce8bd0003ccfcbfa8ed98c18bb640"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/pull/2167"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/releases/tag/7.0.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-4pv2-52v7-vrfx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/social-auth-core-4.7.0-before-7.0.0-login-csrf-via-saml-relaystate"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126776.json b/data/2026/CVE-2026-126776.json index 8c56233cb9..2f569882dc 100644 --- a/data/2026/CVE-2026-126776.json +++ b/data/2026/CVE-2026-126776.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","product":"siyuan","repo":"https://github.com/siyuan-note/siyuan","vendor":"siyuan-note","versions":[{"lessThan":"3.8.10","status":"affected","version":"3.7.0","versionType":"semver"},{"status":"unaffected","version":"3.8.10","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan 3.7.0 before 3.8.10 on Windows contains a path traversal vulnerability in kernel/util/webfetch.go that allows attackers to write files outside the import directory via backslash-encoded filenames. Attackers controlling a URL fetched by the MCP web_fetch or http_request tools can use %5C-encoded ..\\ sequences to write chosen response bytes to directories above temp/import that are writable by the SiYuan user."}],"id":"CVE-2026-126776","lastModified":"2026-11-11T19:17:38.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:38.287","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/blob/v3.7.0/kernel/util/webfetch.go#L155"},{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/commit/94d6a42a0362c0a6938a29ab84addb1fe0aca21c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/releases/tag/v3.8.10"},{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hq2c-hh95-vrr6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/siyuan-3.7.0-before-3.8.10-path-traversal-file-write-via-mcp-web-fetch"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/siyuan-note/siyuan/kernel","product":"siyuan","repo":"https://github.com/siyuan-note/siyuan","vendor":"siyuan-note","versions":[{"lessThan":"3.8.10","status":"affected","version":"3.7.0","versionType":"semver"},{"status":"unaffected","version":"3.8.10","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan 3.7.0 before 3.8.10 on Windows contains a path traversal vulnerability in kernel/util/webfetch.go that allows attackers to write files outside the import directory via backslash-encoded filenames. Attackers controlling a URL fetched by the MCP web_fetch or http_request tools can use %5C-encoded ..\\ sequences to write chosen response bytes to directories above temp/import that are writable by the SiYuan user."}],"id":"CVE-2026-126776","lastModified":"2026-11-12T18:17:27.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126776","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:21.484396Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:38.287","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/blob/v3.7.0/kernel/util/webfetch.go#L155"},{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/commit/94d6a42a0362c0a6938a29ab84addb1fe0aca21c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/releases/tag/v3.8.10"},{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hq2c-hh95-vrr6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/siyuan-3.7.0-before-3.8.10-path-traversal-file-write-via-mcp-web-fetch"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126779.json b/data/2026/CVE-2026-126779.json index 64a1a71f22..10d28470a3 100644 --- a/data/2026/CVE-2026-126779.json +++ b/data/2026/CVE-2026-126779.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://packagist.org","defaultStatus":"unaffected","packageURL":"pkg:composer/spatie/browsershot","product":"browsershot","repo":"https://github.com/spatie/browsershot","vendor":"spatie","versions":[{"lessThan":"5.5.0","status":"affected","version":"2.2.0","versionType":"semver"},{"status":"unaffected","version":"5.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot."}],"id":"CVE-2026-126779","lastModified":"2026-11-11T19:17:38.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:38.840","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/blob/2.2.0/src/Browsershot.php#L242-L248"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/commit/eba71ab7f4aba23d9321d653ccd19d4e94432516"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/pull/989"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/releases/tag/5.5.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/spatie-browsershot-2.2.0-before-5.5.0-local-file-read-via-sethtml"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://packagist.org","defaultStatus":"unaffected","packageURL":"pkg:composer/spatie/browsershot","product":"browsershot","repo":"https://github.com/spatie/browsershot","vendor":"spatie","versions":[{"lessThan":"5.5.0","status":"affected","version":"2.2.0","versionType":"semver"},{"status":"unaffected","version":"5.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot."}],"id":"CVE-2026-126779","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:38.840","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/blob/2.2.0/src/Browsershot.php#L242-L248"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/commit/eba71ab7f4aba23d9321d653ccd19d4e94432516"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/pull/989"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/releases/tag/5.5.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/spatie-browsershot-2.2.0-before-5.5.0-local-file-read-via-sethtml"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126780.json b/data/2026/CVE-2026-126780.json index f313f7719f..3f66ebd50d 100644 --- a/data/2026/CVE-2026-126780.json +++ b/data/2026/CVE-2026-126780.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/webmin/webmin","product":"webmin","repo":"https://github.com/webmin/webmin","vendor":"webmin","versions":[{"lessThanOrEqual":"2.670","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root."}],"id":"CVE-2026-126780","lastModified":"2026-11-11T19:17:39.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:38.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/webmin/webmin/blob/2.670/acl/save_group.cgi#L83"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webmin/webmin/commit/be54ba38c3b86a3647a62327e1de81d5d0db098a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webmin/webmin/commit/c861e308f4ee4cff1795ccc7621fc75623e1bb90"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/webmin-through-2.670-privilege-escalation-via-acl-save-group-cgi"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/webmin/webmin","product":"webmin","repo":"https://github.com/webmin/webmin","vendor":"webmin","versions":[{"lessThanOrEqual":"2.670","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root."}],"id":"CVE-2026-126780","lastModified":"2026-11-12T18:17:27.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126780","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:31:17.611568Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:38.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/webmin/webmin/blob/2.670/acl/save_group.cgi#L83"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webmin/webmin/commit/be54ba38c3b86a3647a62327e1de81d5d0db098a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/webmin/webmin/commit/c861e308f4ee4cff1795ccc7621fc75623e1bb90"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/webmin-through-2.670-privilege-escalation-via-acl-save-group-cgi"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126799.json b/data/2026/CVE-2026-126799.json index 4ce7e70fc9..10dea56d66 100644 --- a/data/2026/CVE-2026-126799.json +++ b/data/2026/CVE-2026-126799.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/gotenberg/gotenberg/v8","product":"gotenberg","vendor":"gotenberg","versions":[{"lessThan":"8.38.0","status":"affected","version":"8.31.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP() that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6 prefixes in downloadFrom, webhook, or Chromium/LibreOffice URLs to reach internal services and read responses in the returned PDF."}],"id":"CVE-2026-126799","lastModified":"2026-11-11T21:16:43.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:43.347","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/blob/v8.37.0/pkg/gotenberg/outbound.go#L112-L142"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/commit/8e850b1c932452627fba397f2005dd6fd57b9617"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/releases/tag/v8.38.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fqg9-x2xw-5crx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gotenberg-8.31.0-before-8.38.0-ssrf-via-ipv6-zone-identifiers-in-ispublicip"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/gotenberg/gotenberg/v8","product":"gotenberg","vendor":"gotenberg","versions":[{"lessThan":"8.38.0","status":"affected","version":"8.31.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP() that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6 prefixes in downloadFrom, webhook, or Chromium/LibreOffice URLs to reach internal services and read responses in the returned PDF."}],"id":"CVE-2026-126799","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:23.798707Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:43.347","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/blob/v8.37.0/pkg/gotenberg/outbound.go#L112-L142"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/commit/8e850b1c932452627fba397f2005dd6fd57b9617"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/releases/tag/v8.38.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fqg9-x2xw-5crx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gotenberg-8.31.0-before-8.38.0-ssrf-via-ipv6-zone-identifiers-in-ispublicip"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126800.json b/data/2026/CVE-2026-126800.json index 91eac7fa6f..9833a7a145 100644 --- a/data/2026/CVE-2026-126800.json +++ b/data/2026/CVE-2026-126800.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/%40hydrooj/ui-default","product":"@hydrooj/ui-default","vendor":"hydro-dev","versions":[{"lessThan":"4.59.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when administrators or other users view it, stealing the non-httpOnly sid session cookie for session hijacking."}],"id":"CVE-2026-126800","lastModified":"2026-11-11T21:16:43.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:43.507","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/hydro-dev/Hydro/blob/3c8286dd1350fcd00412e95d5b056dbfed64edda/packages/ui-default/backendlib/markdown-it-xss.ts#L150-L157"},{"source":"disclosure@vulncheck.com","url":"https://github.com/hydro-dev/Hydro/commit/3bae56fe8edddff12346bcb1c8281269c94688d8"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/hydro/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/hydro-hydrooj-ui-default-before-4.59.1-stored-xss-via-markdown-language-class"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/%40hydrooj/ui-default","product":"@hydrooj/ui-default","vendor":"hydro-dev","versions":[{"lessThan":"4.59.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when administrators or other users view it, stealing the non-httpOnly sid session cookie for session hijacking."}],"id":"CVE-2026-126800","lastModified":"2026-11-12T20:18:33.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126800","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:43:22.451621Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:43.507","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/hydro-dev/Hydro/blob/3c8286dd1350fcd00412e95d5b056dbfed64edda/packages/ui-default/backendlib/markdown-it-xss.ts#L150-L157"},{"source":"disclosure@vulncheck.com","url":"https://github.com/hydro-dev/Hydro/commit/3bae56fe8edddff12346bcb1c8281269c94688d8"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/hydro/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/hydro-hydrooj-ui-default-before-4.59.1-stored-xss-via-markdown-language-class"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126803.json b/data/2026/CVE-2026-126803.json index 60d071c44b..022feea964 100644 --- a/data/2026/CVE-2026-126803.json +++ b/data/2026/CVE-2026-126803.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/rabithua/rote","product":"Rote","vendor":"Rabithua","versions":[{"lessThanOrEqual":"2.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account."}],"id":"CVE-2026-126803","lastModified":"2026-11-11T21:16:44.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.007","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/admin.ts#L86-L146"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/pull/420"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261104/rote/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rote-through-2.6.0-privilege-escalation-via-admin-settings-api-jwt-secret-exposure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/rabithua/rote","product":"Rote","vendor":"Rabithua","versions":[{"lessThanOrEqual":"2.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account."}],"id":"CVE-2026-126803","lastModified":"2026-11-12T18:17:28.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:31:20.090761Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:44.007","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/admin.ts#L86-L146"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/pull/420"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261104/rote/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rote-through-2.6.0-privilege-escalation-via-admin-settings-api-jwt-secret-exposure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126804.json b/data/2026/CVE-2026-126804.json index 8a6e107fc3..e372cea01c 100644 --- a/data/2026/CVE-2026-126804.json +++ b/data/2026/CVE-2026-126804.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"12.4","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated is_regular_user parameter to another user's id or ../ sequences to delete other users' ads or files like videos/configuration.php, taking the site offline and re-exposing the installer."}],"id":"CVE-2026-126804","lastModified":"2026-11-11T21:16:44.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.173","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/ADs/ADs.php#L194-L219"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/ADs/deleteImage.json.php#L53-L63"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/c2b99663d6442e2182a0f3ab95ea6731a193b301"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-58h3-9722-fgpm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-12.4-through-29.7.1-path-traversal-file-deletion-via-deleteimage-json-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"12.4","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated is_regular_user parameter to another user's id or ../ sequences to delete other users' ads or files like videos/configuration.php, taking the site offline and re-exposing the installer."}],"id":"CVE-2026-126804","lastModified":"2026-11-12T20:18:33.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126804","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:42:39.850656Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:44.173","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/ADs/ADs.php#L194-L219"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/ADs/deleteImage.json.php#L53-L63"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/c2b99663d6442e2182a0f3ab95ea6731a193b301"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-58h3-9722-fgpm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-12.4-through-29.7.1-path-traversal-file-deletion-via-deleteimage-json-php"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-58h3-9722-fgpm"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126807.json b/data/2026/CVE-2026-126807.json index c0280e2e49..1a00f1d8cd 100644 --- a/data/2026/CVE-2026-126807.json +++ b/data/2026/CVE-2026-126807.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/asternic/wuzapi","product":"wuzapi","vendor":"asternic","versions":[{"lessThanOrEqual":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chat_jid=index to list every user's internal ID, stored chat JIDs, and last-message times."}],"id":"CVE-2026-126807","lastModified":"2026-11-11T21:16:44.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.800","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/blob/v1.1.0/handlers.go#L7269-L7296"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/blob/v1.1.0/routes.go#L139"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/commit/f5332fa21b7c8a742f9ee565328ea776ad0c8040"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/issues/407"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieund/wuzapi-chat-history-index-cross-tenant-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wuzapi-through-1.1.0-cross-tenant-information-disclosure-via-chat-history"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/asternic/wuzapi","product":"wuzapi","vendor":"asternic","versions":[{"lessThanOrEqual":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chat_jid=index to list every user's internal ID, stored chat JIDs, and last-message times."}],"id":"CVE-2026-126807","lastModified":"2026-11-12T18:17:28.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126807","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:25.999123Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:44.800","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/blob/v1.1.0/handlers.go#L7269-L7296"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/blob/v1.1.0/routes.go#L139"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/commit/f5332fa21b7c8a742f9ee565328ea776ad0c8040"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/issues/407"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieund/wuzapi-chat-history-index-cross-tenant-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wuzapi-through-1.1.0-cross-tenant-information-disclosure-via-chat-history"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126808.json b/data/2026/CVE-2026-126808.json index d55639bfc4..ea53795bd2 100644 --- a/data/2026/CVE-2026-126808.json +++ b/data/2026/CVE-2026-126808.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/wp-erp/wp-erp","product":"ERP","vendor":"weDevs","versions":[{"lessThanOrEqual":"1.17.11","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history."}],"id":"CVE-2026-126808","lastModified":"2026-11-11T21:16:44.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.963","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/issues/1691"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/pull/1693"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wp-erp-through-1.17.11-incorrect-authorization-via-hrm-job-info-ajax-handlers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/wp-erp/wp-erp","product":"ERP","vendor":"weDevs","versions":[{"lessThanOrEqual":"1.17.11","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history."}],"id":"CVE-2026-126808","lastModified":"2026-11-12T20:18:34.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126808","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:42:06.579701Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:44.963","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/issues/1691"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/pull/1693"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wp-erp-through-1.17.11-incorrect-authorization-via-hrm-job-info-ajax-handlers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126811.json b/data/2026/CVE-2026-126811.json index c414052dc4..10a50734dd 100644 --- a/data/2026/CVE-2026-126811.json +++ b/data/2026/CVE-2026-126811.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/BookStackApp/BookStack","product":"BookStack","vendor":"BookStackApp","versions":[{"lessThan":"26.09.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work."}],"id":"CVE-2026-126811","lastModified":"2026-11-11T21:16:45.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:45.507","references":[{"source":"disclosure@vulncheck.com","url":"https://codeberg.org/bookstack/bookstack/commit/4fec06236cbfb314fd72c1b3614c7c50162fb41c"},{"source":"disclosure@vulncheck.com","url":"https://codeberg.org/bookstack/bookstack/commit/926e16a23f346be47d44746d14cba40cb355cbe1"},{"source":"disclosure@vulncheck.com","url":"https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/DrawioImageController.php#L82-L92"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/ImageController.php#L159-L169"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/commit/926e16a23f346be47d44746d14cba40cb355cbe1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fishtankyu/bookstack-draft-image-idor-advisory.md"},{"source":"disclosure@vulncheck.com","url":"https://www.bookstackapp.com/blog/bookstack-release-v26-09-3/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/bookstack-before-26.09.3-incorrect-authorization-via-image-and-drawio-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/BookStackApp/BookStack","product":"BookStack","vendor":"BookStackApp","versions":[{"lessThan":"26.09.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work."}],"id":"CVE-2026-126811","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126811","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:28.270874Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:45.507","references":[{"source":"disclosure@vulncheck.com","url":"https://codeberg.org/bookstack/bookstack/commit/4fec06236cbfb314fd72c1b3614c7c50162fb41c"},{"source":"disclosure@vulncheck.com","url":"https://codeberg.org/bookstack/bookstack/commit/926e16a23f346be47d44746d14cba40cb355cbe1"},{"source":"disclosure@vulncheck.com","url":"https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/DrawioImageController.php#L82-L92"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/ImageController.php#L159-L169"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/commit/926e16a23f346be47d44746d14cba40cb355cbe1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fishtankyu/bookstack-draft-image-idor-advisory.md"},{"source":"disclosure@vulncheck.com","url":"https://www.bookstackapp.com/blog/bookstack-release-v26-09-3/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/bookstack-before-26.09.3-incorrect-authorization-via-image-and-drawio-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126813.json b/data/2026/CVE-2026-126813.json index 94bf5622ff..c257298022 100644 --- a/data/2026/CVE-2026-126813.json +++ b/data/2026/CVE-2026-126813.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/roundcube/roundcubemail","product":"Webmail","vendor":"Roundcube","versions":[{"lessThan":"1.6.21","status":"affected","version":"0","versionType":"semver"},{"lessThan":"1.7.6","status":"affected","version":"1.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL."}],"id":"CVE-2026-126813","lastModified":"2026-11-11T21:16:45.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:45.883","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcube_imap_generic.php#L2892"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.21"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.6"},{"source":"disclosure@vulncheck.com","url":"https://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-command-injection-via-uid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/roundcube/roundcubemail","product":"Webmail","vendor":"Roundcube","versions":[{"lessThan":"1.6.21","status":"affected","version":"0","versionType":"semver"},{"lessThan":"1.7.6","status":"affected","version":"1.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL."}],"id":"CVE-2026-126813","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:45.883","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcube_imap_generic.php#L2892"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.21"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.6"},{"source":"disclosure@vulncheck.com","url":"https://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-command-injection-via-uid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126831.json b/data/2026/CVE-2026-126831.json new file mode 100644 index 0000000000..8bb78ef57a --- /dev/null +++ b/data/2026/CVE-2026-126831.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"cpio","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash."}],"id":"CVE-2026-126831","lastModified":"2026-11-12T18:17:28.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T18:17:28.583","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-126831"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571893"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126835.json b/data/2026/CVE-2026-126835.json new file mode 100644 index 0000000000..ef8a73daee --- /dev/null +++ b/data/2026/CVE-2026-126835.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Node.js Driver","vendor":"MongoDB","versions":[{"lessThan":"7.9.0","status":"affected","version":">= 6.7.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver."}],"id":"CVE-2026-126835","lastModified":"2026-11-12T17:17:33.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-12T17:17:33.147","references":[{"source":"cna@mongodb.com","url":"https://github.com/mongodb/node-mongodb-native/releases/tag/v7.9.0"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-923"}],"source":"cna@mongodb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126837.json b/data/2026/CVE-2026-126837.json new file mode 100644 index 0000000000..7525f7daee --- /dev/null +++ b/data/2026/CVE-2026-126837.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Node.js Driver","vendor":"MongoDB","versions":[{"lessThan":"7.8.0","status":"affected","version":"3.3.3","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the domain of the connection string. The driver then builds the connection address from the original name, in which certain characters end the host name early. An unauthenticated party who can forge or change the DNS SRV response may redirect the connection to a host of their choice. TLS does not prevent this, because the driver verifies the server certificate against the redirected host name. This may result in unintended disclosure of application data and authentication credentials, and in altered query results. Applications that use mongodb:// connection strings are not affected."}],"id":"CVE-2026-126837","lastModified":"2026-11-12T18:17:28.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-12T17:17:33.320","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/NODE-7830"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-180"}],"source":"cna@mongodb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126838.json b/data/2026/CVE-2026-126838.json new file mode 100644 index 0000000000..523513959e --- /dev/null +++ b/data/2026/CVE-2026-126838.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Rust Driver","vendor":"MongoDB","versions":[{"lessThan":"3.9.1","status":"affected","version":"3.9.0","versionType":"semver"},{"lessThan":"3.8.2","status":"affected","version":"3.8.0","versionType":"semver"},{"status":"affected","version":"3.7.0","versionType":"semver"},{"status":"affected","version":"3.6.0","versionType":"semver"},{"lessThan":"3.5.2","status":"affected","version":"3.5.0","versionType":"semver"},{"lessThan":"3.4.1","status":"affected","version":"3.4.0","versionType":"semver"},{"status":"affected","version":"3.3.0","versionType":"semver"},{"lessThan":"3.2.5","status":"affected","version":"3.2.0","versionType":"semver"},{"lessThan":"3.1.1","status":"affected","version":"3.1.0","versionType":"semver"},{"lessThan":"3.0.1","status":"affected","version":"3.0.0","versionType":"semver"},{"lessThan":"2.8.2","status":"affected","version":"2.8.0","versionType":"semver"},{"lessThan":"2.7.1","status":"affected","version":"2.7.0","versionType":"semver"},{"lessThan":"2.6.1","status":"affected","version":"2.6.0","versionType":"semver"},{"status":"affected","version":"2.5.0","versionType":"semver"},{"status":"affected","version":"2.4.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material."}],"id":"CVE-2026-126838","lastModified":"2026-11-12T19:17:01.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-12T19:17:01.570","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/RUST-2531"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"cna@mongodb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126840.json b/data/2026/CVE-2026-126840.json index 55ae00435b..31df50f77d 100644 --- a/data/2026/CVE-2026-126840.json +++ b/data/2026/CVE-2026-126840.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in Network in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126840","lastModified":"2026-11-11T23:17:11.670","metrics":{},"published":"2026-11-11T23:17:11.553","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578664961"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in Network in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126840","lastModified":"2026-11-12T19:51:24.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126840","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:04:36.412331Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:11.553","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/578664961"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126841.json b/data/2026/CVE-2026-126841.json index 1db9806430..271332b732 100644 --- a/data/2026/CVE-2026-126841.json +++ b/data/2026/CVE-2026-126841.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126841","lastModified":"2026-11-11T23:17:11.820","metrics":{},"published":"2026-11-11T23:17:11.703","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580865537"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126841","lastModified":"2026-11-12T19:17:01.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126841","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:18.114525Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:11.703","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580865537"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126842.json b/data/2026/CVE-2026-126842.json index e4fb080a37..1a34bc0eb8 100644 --- a/data/2026/CVE-2026-126842.json +++ b/data/2026/CVE-2026-126842.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126842","lastModified":"2026-11-11T23:17:11.970","metrics":{},"published":"2026-11-11T23:17:11.860","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574209539"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126842","lastModified":"2026-11-12T17:17:33.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126842","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:40.155948Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:11.860","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574209539"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126843.json b/data/2026/CVE-2026-126843.json index 19374aff56..5cf2d21b32 100644 --- a/data/2026/CVE-2026-126843.json +++ b/data/2026/CVE-2026-126843.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126843","lastModified":"2026-11-11T23:17:12.110","metrics":{},"published":"2026-11-11T23:17:12.000","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578322433"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126843","lastModified":"2026-11-12T17:17:33.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126843","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:05:04.973455Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.000","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578322433"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126844.json b/data/2026/CVE-2026-126844.json index 8e4dff32f2..192f9ae249 100644 --- a/data/2026/CVE-2026-126844.json +++ b/data/2026/CVE-2026-126844.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126844","lastModified":"2026-11-11T23:17:12.247","metrics":{},"published":"2026-11-11T23:17:12.147","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576944655"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126844","lastModified":"2026-11-12T19:17:01.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126844","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:22.963313Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.147","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576944655"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126845.json b/data/2026/CVE-2026-126845.json index 98b8f6fc66..02209f9823 100644 --- a/data/2026/CVE-2026-126845.json +++ b/data/2026/CVE-2026-126845.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126845","lastModified":"2026-11-11T23:17:12.373","metrics":{},"published":"2026-11-11T23:17:12.277","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574795295"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126845","lastModified":"2026-11-12T19:17:02.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126845","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:25.120030Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.277","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574795295"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126846.json b/data/2026/CVE-2026-126846.json index a6e174b9af..23ab922117 100644 --- a/data/2026/CVE-2026-126846.json +++ b/data/2026/CVE-2026-126846.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126846","lastModified":"2026-11-11T23:17:12.493","metrics":{},"published":"2026-11-11T23:17:12.403","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580857377"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126846","lastModified":"2026-11-12T17:17:34.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126846","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:09:51.162825Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.403","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580857377"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126847.json b/data/2026/CVE-2026-126847.json index df5eaa7ceb..0532dfca47 100644 --- a/data/2026/CVE-2026-126847.json +++ b/data/2026/CVE-2026-126847.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126847","lastModified":"2026-11-11T23:17:12.623","metrics":{},"published":"2026-11-11T23:17:12.527","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/572988453"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126847","lastModified":"2026-11-12T19:51:12.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126847","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:08:16.762764Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.527","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/572988453"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126848.json b/data/2026/CVE-2026-126848.json index 85effb2649..5bcd4e7ef8 100644 --- a/data/2026/CVE-2026-126848.json +++ b/data/2026/CVE-2026-126848.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126848","lastModified":"2026-11-11T23:17:12.760","metrics":{},"published":"2026-11-11T23:17:12.650","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578685477"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126848","lastModified":"2026-11-12T19:17:02.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:20.402133Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.650","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578685477"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126849.json b/data/2026/CVE-2026-126849.json index ab2322be17..8268b2ef42 100644 --- a/data/2026/CVE-2026-126849.json +++ b/data/2026/CVE-2026-126849.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126849","lastModified":"2026-11-11T23:17:12.907","metrics":{},"published":"2026-11-11T23:17:12.793","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579313193"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126849","lastModified":"2026-11-12T19:50:59.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126849","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:04:10.288708Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.793","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/579313193"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126850.json b/data/2026/CVE-2026-126850.json index a77b7ffb71..95f6232e42 100644 --- a/data/2026/CVE-2026-126850.json +++ b/data/2026/CVE-2026-126850.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126850","lastModified":"2026-11-11T23:17:13.037","metrics":{},"published":"2026-11-11T23:17:12.937","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580853808"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126850","lastModified":"2026-11-12T18:17:29.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:59.630744Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.937","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580853808"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126851.json b/data/2026/CVE-2026-126851.json index 8579e9e85d..686455219b 100644 --- a/data/2026/CVE-2026-126851.json +++ b/data/2026/CVE-2026-126851.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126851","lastModified":"2026-11-11T23:17:13.170","metrics":{},"published":"2026-11-11T23:17:13.070","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574792758"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126851","lastModified":"2026-11-12T17:17:34.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126851","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:21.890710Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.070","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574792758"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126852.json b/data/2026/CVE-2026-126852.json index 0eb471a55b..29f4a3044c 100644 --- a/data/2026/CVE-2026-126852.json +++ b/data/2026/CVE-2026-126852.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126852","lastModified":"2026-11-11T23:17:13.293","metrics":{},"published":"2026-11-11T23:17:13.200","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580846651"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126852","lastModified":"2026-11-12T17:17:34.853","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126852","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:03:51.437745Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.200","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580846651"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126853.json b/data/2026/CVE-2026-126853.json index dc2551930c..3792ac9465 100644 --- a/data/2026/CVE-2026-126853.json +++ b/data/2026/CVE-2026-126853.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126853","lastModified":"2026-11-11T23:17:13.440","metrics":{},"published":"2026-11-11T23:17:13.327","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/573263421"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126853","lastModified":"2026-11-12T19:17:02.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126853","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:29.688421Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.327","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/573263421"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126854.json b/data/2026/CVE-2026-126854.json index a7607cb41c..989753ba9f 100644 --- a/data/2026/CVE-2026-126854.json +++ b/data/2026/CVE-2026-126854.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126854","lastModified":"2026-11-11T23:17:13.580","metrics":{},"published":"2026-11-11T23:17:13.473","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578655807"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126854","lastModified":"2026-11-12T18:17:29.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126854","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:08.955854Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.473","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578655807"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126855.json b/data/2026/CVE-2026-126855.json index 4a7b6e8f32..46cf324ae5 100644 --- a/data/2026/CVE-2026-126855.json +++ b/data/2026/CVE-2026-126855.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126855","lastModified":"2026-11-11T23:17:13.713","metrics":{},"published":"2026-11-11T23:17:13.610","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579300424"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126855","lastModified":"2026-11-12T18:17:30.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126855","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:38:42.950737Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.610","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579300424"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126856.json b/data/2026/CVE-2026-126856.json index 722be1360a..dfac0a290d 100644 --- a/data/2026/CVE-2026-126856.json +++ b/data/2026/CVE-2026-126856.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in Cache in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126856","lastModified":"2026-11-11T23:17:13.850","metrics":{},"published":"2026-11-11T23:17:13.747","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577260644"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in Cache in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126856","lastModified":"2026-11-12T18:17:30.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126856","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:22.043612Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.747","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577260644"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126857.json b/data/2026/CVE-2026-126857.json index 09b685bd04..e6719ec370 100644 --- a/data/2026/CVE-2026-126857.json +++ b/data/2026/CVE-2026-126857.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126857","lastModified":"2026-11-11T23:17:13.977","metrics":{},"published":"2026-11-11T23:17:13.883","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656869"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126857","lastModified":"2026-11-12T18:17:31.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126857","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:02.632859Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.883","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656869"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126858.json b/data/2026/CVE-2026-126858.json index ebd7d3ef3f..0357301e9f 100644 --- a/data/2026/CVE-2026-126858.json +++ b/data/2026/CVE-2026-126858.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126858","lastModified":"2026-11-11T23:17:14.110","metrics":{},"published":"2026-11-11T23:17:14.010","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575937643"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126858","lastModified":"2026-11-12T18:17:32.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126858","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:48:04.810108Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.010","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575937643"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126859.json b/data/2026/CVE-2026-126859.json index 0a16de47da..2a2e8becba 100644 --- a/data/2026/CVE-2026-126859.json +++ b/data/2026/CVE-2026-126859.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126859","lastModified":"2026-11-11T23:17:14.257","metrics":{},"published":"2026-11-11T23:17:14.153","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/563340397"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126859","lastModified":"2026-11-12T19:50:42.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126859","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:09:13.436915Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.153","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/563340397"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126860.json b/data/2026/CVE-2026-126860.json index fea8b8d37e..67174e15ec 100644 --- a/data/2026/CVE-2026-126860.json +++ b/data/2026/CVE-2026-126860.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126860","lastModified":"2026-11-11T23:17:14.390","metrics":{},"published":"2026-11-11T23:17:14.287","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/581785712"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126860","lastModified":"2026-11-12T19:50:30.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126860","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:03:16.361001Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.287","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/581785712"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126861.json b/data/2026/CVE-2026-126861.json index 4e097c7934..b253b64591 100644 --- a/data/2026/CVE-2026-126861.json +++ b/data/2026/CVE-2026-126861.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Media in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126861","lastModified":"2026-11-11T23:17:14.523","metrics":{},"published":"2026-11-11T23:17:14.423","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577171064"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Media in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126861","lastModified":"2026-11-12T19:50:16.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126861","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:06:09.602741Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.423","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/577171064"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126862.json b/data/2026/CVE-2026-126862.json index e9dcfde355..a4834fab56 100644 --- a/data/2026/CVE-2026-126862.json +++ b/data/2026/CVE-2026-126862.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High)"}],"id":"CVE-2026-126862","lastModified":"2026-11-11T23:17:14.650","metrics":{},"published":"2026-11-11T23:17:14.553","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574381704"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High)"}],"id":"CVE-2026-126862","lastModified":"2026-11-12T18:17:32.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126862","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:47:19.558062Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.553","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574381704"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126863.json b/data/2026/CVE-2026-126863.json index 11da30dd5e..2017d9e433 100644 --- a/data/2026/CVE-2026-126863.json +++ b/data/2026/CVE-2026-126863.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in HTML in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126863","lastModified":"2026-11-11T23:17:14.790","metrics":{},"published":"2026-11-11T23:17:14.687","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575312521"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in HTML in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126863","lastModified":"2026-11-12T17:17:35.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126863","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:06:55.356350Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.687","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575312521"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126864.json b/data/2026/CVE-2026-126864.json index a1c1d85bb6..7a0fa9f3db 100644 --- a/data/2026/CVE-2026-126864.json +++ b/data/2026/CVE-2026-126864.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126864","lastModified":"2026-11-11T23:17:14.930","metrics":{},"published":"2026-11-11T23:17:14.820","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567827593"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126864","lastModified":"2026-11-12T17:17:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126864","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:09:33.186628Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.820","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567827593"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126865.json b/data/2026/CVE-2026-126865.json index b132524eaf..408750530f 100644 --- a/data/2026/CVE-2026-126865.json +++ b/data/2026/CVE-2026-126865.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DOM in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126865","lastModified":"2026-11-11T23:17:15.070","metrics":{},"published":"2026-11-11T23:17:14.960","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/573335176"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DOM in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126865","lastModified":"2026-11-12T17:17:36.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126865","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:08:07.880522Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.960","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/573335176"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126866.json b/data/2026/CVE-2026-126866.json index 8ce1745911..7a732f7c78 100644 --- a/data/2026/CVE-2026-126866.json +++ b/data/2026/CVE-2026-126866.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}],"id":"CVE-2026-126866","lastModified":"2026-11-11T23:17:15.200","metrics":{},"published":"2026-11-11T23:17:15.103","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576943246"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}],"id":"CVE-2026-126866","lastModified":"2026-11-12T18:17:33.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126866","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:44:41.682739Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.103","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576943246"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126867.json b/data/2026/CVE-2026-126867.json index cca802e28d..c9e4516bc8 100644 --- a/data/2026/CVE-2026-126867.json +++ b/data/2026/CVE-2026-126867.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Browser in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126867","lastModified":"2026-11-11T23:17:15.323","metrics":{},"published":"2026-11-11T23:17:15.230","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575086736"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Browser in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126867","lastModified":"2026-11-12T17:17:36.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:04.244913Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.230","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575086736"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126868.json b/data/2026/CVE-2026-126868.json index c363a79ee4..71e86e9d42 100644 --- a/data/2026/CVE-2026-126868.json +++ b/data/2026/CVE-2026-126868.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126868","lastModified":"2026-11-11T23:17:15.483","metrics":{},"published":"2026-11-11T23:17:15.363","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580867734"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126868","lastModified":"2026-11-12T17:17:36.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126868","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:03:42.850780Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.363","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580867734"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126869.json b/data/2026/CVE-2026-126869.json index 5a49007323..bfa4afe674 100644 --- a/data/2026/CVE-2026-126869.json +++ b/data/2026/CVE-2026-126869.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126869","lastModified":"2026-11-11T23:17:15.617","metrics":{},"published":"2026-11-11T23:17:15.517","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575533210"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126869","lastModified":"2026-11-12T17:17:36.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126869","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:06:46.570742Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.517","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575533210"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126870.json b/data/2026/CVE-2026-126870.json index f699e17192..9ff7cd39e8 100644 --- a/data/2026/CVE-2026-126870.json +++ b/data/2026/CVE-2026-126870.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126870","lastModified":"2026-11-11T23:17:15.750","metrics":{},"published":"2026-11-11T23:17:15.647","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/568906910"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126870","lastModified":"2026-11-12T18:17:33.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:45:33.058730Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.647","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/568906910"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126871.json b/data/2026/CVE-2026-126871.json index ad4b79be2e..4e3ce81cd7 100644 --- a/data/2026/CVE-2026-126871.json +++ b/data/2026/CVE-2026-126871.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126871","lastModified":"2026-11-11T23:17:15.873","metrics":{},"published":"2026-11-11T23:17:15.780","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574218401"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126871","lastModified":"2026-11-12T18:17:34.047","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126871","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:45:11.389801Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.780","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574218401"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126872.json b/data/2026/CVE-2026-126872.json index cecf72daee..1e60a09d1a 100644 --- a/data/2026/CVE-2026-126872.json +++ b/data/2026/CVE-2026-126872.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126872","lastModified":"2026-11-11T23:17:16.010","metrics":{},"published":"2026-11-11T23:17:15.907","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577376424"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126872","lastModified":"2026-11-12T17:17:36.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126872","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:05:22.522611Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:15.907","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577376424"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126873.json b/data/2026/CVE-2026-126873.json index 08577f5480..fdf198fa55 100644 --- a/data/2026/CVE-2026-126873.json +++ b/data/2026/CVE-2026-126873.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126873","lastModified":"2026-11-11T23:17:16.130","metrics":{},"published":"2026-11-11T23:17:16.040","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577336494"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126873","lastModified":"2026-11-12T17:17:37.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126873","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:05:41.165244Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.040","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577336494"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126874.json b/data/2026/CVE-2026-126874.json index 913524561d..8e4865bcba 100644 --- a/data/2026/CVE-2026-126874.json +++ b/data/2026/CVE-2026-126874.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126874","lastModified":"2026-11-11T23:17:16.277","metrics":{},"published":"2026-11-11T23:17:16.163","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576439987"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126874","lastModified":"2026-11-12T17:17:37.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126874","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:06:37.325880Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.163","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576439987"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126875.json b/data/2026/CVE-2026-126875.json index 80135a5812..c8516f357a 100644 --- a/data/2026/CVE-2026-126875.json +++ b/data/2026/CVE-2026-126875.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126875","lastModified":"2026-11-11T23:17:16.413","metrics":{},"published":"2026-11-11T23:17:16.310","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574222006"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126875","lastModified":"2026-11-12T18:17:34.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126875","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:46:49.566157Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.310","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574222006"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126876.json b/data/2026/CVE-2026-126876.json index 9159b6136e..74e27d755c 100644 --- a/data/2026/CVE-2026-126876.json +++ b/data/2026/CVE-2026-126876.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126876","lastModified":"2026-11-11T23:17:16.550","metrics":{},"published":"2026-11-11T23:17:16.450","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576664769"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126876","lastModified":"2026-11-12T17:17:37.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126876","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:06:27.499257Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.450","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576664769"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126877.json b/data/2026/CVE-2026-126877.json index c53e3ef383..6e46ac0aef 100644 --- a/data/2026/CVE-2026-126877.json +++ b/data/2026/CVE-2026-126877.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126877","lastModified":"2026-11-12T16:19:05.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126877","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:56:16.354117Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.580","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577377985"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126877","lastModified":"2026-11-12T19:50:02.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126877","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:56:16.354117Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.580","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/577377985"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126878.json b/data/2026/CVE-2026-126878.json index 18c607673c..505bfd8a81 100644 --- a/data/2026/CVE-2026-126878.json +++ b/data/2026/CVE-2026-126878.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126878","lastModified":"2026-11-11T23:17:16.830","metrics":{},"published":"2026-11-11T23:17:16.723","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/572312779"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126878","lastModified":"2026-11-12T20:18:34.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:59:21.048272Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.723","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/572312779"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126879.json b/data/2026/CVE-2026-126879.json index 830001cbec..fcbb501044 100644 --- a/data/2026/CVE-2026-126879.json +++ b/data/2026/CVE-2026-126879.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126879","lastModified":"2026-11-11T23:17:16.970","metrics":{},"published":"2026-11-11T23:17:16.860","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576736463"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126879","lastModified":"2026-11-12T19:49:50.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126879","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:10:01.706714Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.860","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/576736463"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126880.json b/data/2026/CVE-2026-126880.json index 4ec8e9c5c7..90c30035a9 100644 --- a/data/2026/CVE-2026-126880.json +++ b/data/2026/CVE-2026-126880.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126880","lastModified":"2026-11-11T23:17:17.103","metrics":{},"published":"2026-11-11T23:17:17.007","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577366752"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126880","lastModified":"2026-11-12T19:49:38.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126880","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:05:32.174706Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.007","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/577366752"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126881.json b/data/2026/CVE-2026-126881.json index b1a94d1429..1bc2444d29 100644 --- a/data/2026/CVE-2026-126881.json +++ b/data/2026/CVE-2026-126881.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126881","lastModified":"2026-11-11T23:17:17.240","metrics":{},"published":"2026-11-11T23:17:17.137","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575038730"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-665"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126881","lastModified":"2026-11-12T19:49:24.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126881","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:12.531354Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.137","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/575038730"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-665"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126882.json b/data/2026/CVE-2026-126882.json index a270230eff..b3d5a45dcb 100644 --- a/data/2026/CVE-2026-126882.json +++ b/data/2026/CVE-2026-126882.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126882","lastModified":"2026-11-11T23:17:17.367","metrics":{},"published":"2026-11-11T23:17:17.270","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578685706"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126882","lastModified":"2026-11-12T19:17:02.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126882","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:29:43.071817Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.270","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578685706"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126883.json b/data/2026/CVE-2026-126883.json index 800e849f3f..829879dc09 100644 --- a/data/2026/CVE-2026-126883.json +++ b/data/2026/CVE-2026-126883.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126883","lastModified":"2026-11-12T16:19:05.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126883","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:56:12.284015Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.400","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578659604"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126883","lastModified":"2026-11-12T19:49:11.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126883","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:56:12.284015Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.400","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/578659604"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126884.json b/data/2026/CVE-2026-126884.json index 8a6fb51dc3..33f50c2e21 100644 --- a/data/2026/CVE-2026-126884.json +++ b/data/2026/CVE-2026-126884.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126884","lastModified":"2026-11-11T23:17:17.620","metrics":{},"published":"2026-11-11T23:17:17.523","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576949530"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126884","lastModified":"2026-11-12T18:17:35.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126884","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:39:10.422898Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.523","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576949530"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126885.json b/data/2026/CVE-2026-126885.json index 7193f1f193..ead21a03ea 100644 --- a/data/2026/CVE-2026-126885.json +++ b/data/2026/CVE-2026-126885.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126885","lastModified":"2026-11-11T23:17:17.747","metrics":{},"published":"2026-11-11T23:17:17.650","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/568699166"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126885","lastModified":"2026-11-12T17:17:38.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126885","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:10:21.676320Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.650","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/568699166"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126886.json b/data/2026/CVE-2026-126886.json index 29ffc3e855..0162773268 100644 --- a/data/2026/CVE-2026-126886.json +++ b/data/2026/CVE-2026-126886.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126886","lastModified":"2026-11-11T23:17:17.880","metrics":{},"published":"2026-11-11T23:17:17.780","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567611696"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126886","lastModified":"2026-11-12T17:17:38.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126886","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:09:03.502765Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.780","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567611696"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126887.json b/data/2026/CVE-2026-126887.json index 7625be2d04..8212e0103d 100644 --- a/data/2026/CVE-2026-126887.json +++ b/data/2026/CVE-2026-126887.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Animation in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126887","lastModified":"2026-11-11T23:17:18.003","metrics":{},"published":"2026-11-11T23:17:17.907","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567611698"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Animation in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126887","lastModified":"2026-11-12T17:17:38.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126887","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:08:53.003235Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.907","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567611698"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126888.json b/data/2026/CVE-2026-126888.json index 81ba5a3d1f..8f4c1b2199 100644 --- a/data/2026/CVE-2026-126888.json +++ b/data/2026/CVE-2026-126888.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126888","lastModified":"2026-11-11T23:17:18.150","metrics":{},"published":"2026-11-11T23:17:18.033","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577461556"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126888","lastModified":"2026-11-12T17:17:38.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126888","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:05:13.758702Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.033","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577461556"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126889.json b/data/2026/CVE-2026-126889.json index 0706f749ec..b5b42b5a78 100644 --- a/data/2026/CVE-2026-126889.json +++ b/data/2026/CVE-2026-126889.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126889","lastModified":"2026-11-11T23:17:18.277","metrics":{},"published":"2026-11-11T23:17:18.180","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/560620348"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126889","lastModified":"2026-11-12T17:17:38.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126889","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:09:24.219496Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.180","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/560620348"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126890.json b/data/2026/CVE-2026-126890.json index 70a317106b..b206dfea10 100644 --- a/data/2026/CVE-2026-126890.json +++ b/data/2026/CVE-2026-126890.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126890","lastModified":"2026-11-11T23:17:18.420","metrics":{},"published":"2026-11-11T23:17:18.307","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/581629247"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126890","lastModified":"2026-11-12T17:17:39.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126890","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:03:25.270694Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.307","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/581629247"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126891.json b/data/2026/CVE-2026-126891.json index 224ddcbb41..1667b4a61b 100644 --- a/data/2026/CVE-2026-126891.json +++ b/data/2026/CVE-2026-126891.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126891","lastModified":"2026-11-11T23:17:18.580","metrics":{},"published":"2026-11-11T23:17:18.460","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575939904"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126891","lastModified":"2026-11-12T18:17:35.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:34:48.306282Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.460","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575939904"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126892.json b/data/2026/CVE-2026-126892.json index 0ada36bde1..d69972e69b 100644 --- a/data/2026/CVE-2026-126892.json +++ b/data/2026/CVE-2026-126892.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126892","lastModified":"2026-11-11T23:17:18.733","metrics":{},"published":"2026-11-11T23:17:18.617","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656065"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126892","lastModified":"2026-11-12T17:17:39.357","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126892","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:04:54.430868Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.617","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656065"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126893.json b/data/2026/CVE-2026-126893.json index 471ef14637..cf25f2cc26 100644 --- a/data/2026/CVE-2026-126893.json +++ b/data/2026/CVE-2026-126893.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126893","lastModified":"2026-11-11T23:17:18.857","metrics":{},"published":"2026-11-11T23:17:18.760","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579278668"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126893","lastModified":"2026-11-12T17:17:39.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:04:27.710684Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.760","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579278668"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126894.json b/data/2026/CVE-2026-126894.json index 4eb8e898a6..bffc8c5e8b 100644 --- a/data/2026/CVE-2026-126894.json +++ b/data/2026/CVE-2026-126894.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126894","lastModified":"2026-11-11T23:17:18.993","metrics":{},"published":"2026-11-11T23:17:18.890","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576950618"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126894","lastModified":"2026-11-12T18:17:36.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126894","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:30:23.350700Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.890","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576950618"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126895.json b/data/2026/CVE-2026-126895.json index 980ebd4230..53e7303329 100644 --- a/data/2026/CVE-2026-126895.json +++ b/data/2026/CVE-2026-126895.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126895","lastModified":"2026-11-11T23:17:19.140","metrics":{},"published":"2026-11-11T23:17:19.020","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575524700"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126895","lastModified":"2026-11-12T17:17:39.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126895","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:10:12.478835Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:19.020","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575524700"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126896.json b/data/2026/CVE-2026-126896.json index 235f20c655..93a830f789 100644 --- a/data/2026/CVE-2026-126896.json +++ b/data/2026/CVE-2026-126896.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126896","lastModified":"2026-11-11T23:17:19.277","metrics":{},"published":"2026-11-11T23:17:19.170","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575524702"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126896","lastModified":"2026-11-12T18:17:36.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126896","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:47:41.330854Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:19.170","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575524702"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126897.json b/data/2026/CVE-2026-126897.json index 26167930cd..5201d85444 100644 --- a/data/2026/CVE-2026-126897.json +++ b/data/2026/CVE-2026-126897.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126897","lastModified":"2026-11-11T23:17:19.417","metrics":{},"published":"2026-11-11T23:17:19.307","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656106"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126897","lastModified":"2026-11-12T17:17:39.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126897","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:04:44.640823Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:19.307","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656106"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126898.json b/data/2026/CVE-2026-126898.json index a7de7a4303..bbc31a39ff 100644 --- a/data/2026/CVE-2026-126898.json +++ b/data/2026/CVE-2026-126898.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126898","lastModified":"2026-11-11T23:17:19.563","metrics":{},"published":"2026-11-11T23:17:19.450","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574216555"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126898","lastModified":"2026-11-12T18:17:36.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126898","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:28.625305Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:19.450","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574216555"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126899.json b/data/2026/CVE-2026-126899.json index 8ff323fee8..5d1df355af 100644 --- a/data/2026/CVE-2026-126899.json +++ b/data/2026/CVE-2026-126899.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126899","lastModified":"2026-11-11T23:17:19.697","metrics":{},"published":"2026-11-11T23:17:19.600","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/583122799"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126899","lastModified":"2026-11-12T17:17:40.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126899","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:03:08.010590Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:19.600","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/583122799"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126900.json b/data/2026/CVE-2026-126900.json index 66a7d8f98f..6adf5e96d7 100644 --- a/data/2026/CVE-2026-126900.json +++ b/data/2026/CVE-2026-126900.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126900","lastModified":"2026-11-11T23:17:19.823","metrics":{},"published":"2026-11-11T23:17:19.730","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574409610"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126900","lastModified":"2026-11-12T17:17:40.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126900","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:31.090816Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:19.730","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574409610"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126901.json b/data/2026/CVE-2026-126901.json index d7a46c9868..034d25bd3c 100644 --- a/data/2026/CVE-2026-126901.json +++ b/data/2026/CVE-2026-126901.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PDF in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126901","lastModified":"2026-11-11T23:17:19.963","metrics":{},"published":"2026-11-11T23:17:19.857","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579818899"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PDF in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126901","lastModified":"2026-11-12T17:17:40.523","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126901","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:04:00.710214Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:19.857","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579818899"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126903.json b/data/2026/CVE-2026-126903.json index 5a77a8795f..f0246ed08c 100644 --- a/data/2026/CVE-2026-126903.json +++ b/data/2026/CVE-2026-126903.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126903","lastModified":"2026-11-11T23:17:20.237","metrics":{},"published":"2026-11-11T23:17:20.133","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574035865"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126903","lastModified":"2026-11-12T19:17:02.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126903","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:46:31.734928Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.133","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574035865"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126905.json b/data/2026/CVE-2026-126905.json index da2b065006..91ae96fe14 100644 --- a/data/2026/CVE-2026-126905.json +++ b/data/2026/CVE-2026-126905.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126905","lastModified":"2026-11-11T23:17:20.507","metrics":{},"published":"2026-11-11T23:17:20.403","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577305517"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126905","lastModified":"2026-11-12T17:17:40.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126905","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:05:49.671651Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.403","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577305517"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126906.json b/data/2026/CVE-2026-126906.json index dfd10180ed..daf40919ac 100644 --- a/data/2026/CVE-2026-126906.json +++ b/data/2026/CVE-2026-126906.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High)"}],"id":"CVE-2026-126906","lastModified":"2026-11-11T23:17:20.660","metrics":{},"published":"2026-11-11T23:17:20.553","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578693038"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High)"}],"id":"CVE-2026-126906","lastModified":"2026-11-12T18:17:37.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126906","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:38:18.116823Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.553","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578693038"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126907.json b/data/2026/CVE-2026-126907.json index 4649248991..eacd89ed46 100644 --- a/data/2026/CVE-2026-126907.json +++ b/data/2026/CVE-2026-126907.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126907","lastModified":"2026-11-11T23:17:20.800","metrics":{},"published":"2026-11-11T23:17:20.697","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574791611"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126907","lastModified":"2026-11-12T19:17:03.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126907","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:27.407627Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.697","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574791611"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126908.json b/data/2026/CVE-2026-126908.json index 773ce3a92d..12ffb400ec 100644 --- a/data/2026/CVE-2026-126908.json +++ b/data/2026/CVE-2026-126908.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126908","lastModified":"2026-11-11T23:17:20.937","metrics":{},"published":"2026-11-11T23:17:20.830","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579313083"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126908","lastModified":"2026-11-12T17:17:40.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126908","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:04:18.557998Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.830","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579313083"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126909.json b/data/2026/CVE-2026-126909.json index fbf70e2d4c..59a438964e 100644 --- a/data/2026/CVE-2026-126909.json +++ b/data/2026/CVE-2026-126909.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Passwords in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126909","lastModified":"2026-11-11T23:17:21.060","metrics":{},"published":"2026-11-11T23:17:20.963","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/572501958"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Passwords in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126909","lastModified":"2026-11-12T17:17:41.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126909","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:08:25.766234Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.963","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/572501958"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126910.json b/data/2026/CVE-2026-126910.json index 10f3b49d1e..6b5d3d9171 100644 --- a/data/2026/CVE-2026-126910.json +++ b/data/2026/CVE-2026-126910.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126910","lastModified":"2026-11-11T23:17:21.193","metrics":{},"published":"2026-11-11T23:17:21.093","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574059463"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126910","lastModified":"2026-11-12T17:17:41.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126910","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:48.645152Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:21.093","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574059463"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126911.json b/data/2026/CVE-2026-126911.json index a22dced504..3040211117 100644 --- a/data/2026/CVE-2026-126911.json +++ b/data/2026/CVE-2026-126911.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126911","lastModified":"2026-11-11T23:17:21.320","metrics":{},"published":"2026-11-11T23:17:21.220","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580921803"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126911","lastModified":"2026-11-12T17:17:41.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126911","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:09:42.248341Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:21.220","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580921803"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126912.json b/data/2026/CVE-2026-126912.json index 5818ae5063..bed16e646d 100644 --- a/data/2026/CVE-2026-126912.json +++ b/data/2026/CVE-2026-126912.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126912","lastModified":"2026-11-11T23:17:21.473","metrics":{},"published":"2026-11-11T23:17:21.357","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/569286603"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126912","lastModified":"2026-11-12T17:17:41.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126912","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:08:43.044619Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:21.357","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/569286603"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126913.json b/data/2026/CVE-2026-126913.json index e41b159514..476bc130e6 100644 --- a/data/2026/CVE-2026-126913.json +++ b/data/2026/CVE-2026-126913.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126913","lastModified":"2026-11-11T23:17:21.630","metrics":{},"published":"2026-11-11T23:17:21.513","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580875215"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126913","lastModified":"2026-11-12T18:17:37.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.4,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126913","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:35:23.723339Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:21.513","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580875215"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126914.json b/data/2026/CVE-2026-126914.json index b397862c73..885bff1561 100644 --- a/data/2026/CVE-2026-126914.json +++ b/data/2026/CVE-2026-126914.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126914","lastModified":"2026-11-11T23:17:21.763","metrics":{},"published":"2026-11-11T23:17:21.660","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577346516"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126914","lastModified":"2026-11-12T18:17:37.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126914","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:15.499445Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:21.660","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577346516"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126916.json b/data/2026/CVE-2026-126916.json index 88f5d68ab0..3c37767f0a 100644 --- a/data/2026/CVE-2026-126916.json +++ b/data/2026/CVE-2026-126916.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126916","lastModified":"2026-11-11T23:17:22.070","metrics":{},"published":"2026-11-11T23:17:21.950","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574025697"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126916","lastModified":"2026-11-12T17:17:41.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126916","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:58.066678Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:21.950","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574025697"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126917.json b/data/2026/CVE-2026-126917.json index 42062febe5..82acba7213 100644 --- a/data/2026/CVE-2026-126917.json +++ b/data/2026/CVE-2026-126917.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126917","lastModified":"2026-11-11T23:17:22.237","metrics":{},"published":"2026-11-11T23:17:22.107","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577242082"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126917","lastModified":"2026-11-12T17:17:42.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126917","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:05:59.246666Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:22.107","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577242082"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126918.json b/data/2026/CVE-2026-126918.json index ac50c3a1bb..65230a589d 100644 --- a/data/2026/CVE-2026-126918.json +++ b/data/2026/CVE-2026-126918.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126918","lastModified":"2026-11-11T23:17:22.367","metrics":{},"published":"2026-11-11T23:17:22.267","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576855527"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126918","lastModified":"2026-11-12T17:17:42.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126918","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:06:19.022946Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:22.267","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576855527"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126919.json b/data/2026/CVE-2026-126919.json index e83b6c5149..a5a97f1f0c 100644 --- a/data/2026/CVE-2026-126919.json +++ b/data/2026/CVE-2026-126919.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in BrowserTag in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126919","lastModified":"2026-11-11T23:17:22.500","metrics":{},"published":"2026-11-11T23:17:22.397","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/569674220"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in BrowserTag in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126919","lastModified":"2026-11-12T17:17:42.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126919","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:08:34.442731Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:22.397","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/569674220"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126920.json b/data/2026/CVE-2026-126920.json index 47a8fb8f85..f6c23f2007 100644 --- a/data/2026/CVE-2026-126920.json +++ b/data/2026/CVE-2026-126920.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126920","lastModified":"2026-11-11T23:17:22.623","metrics":{},"published":"2026-11-11T23:17:22.527","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/581903854"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126920","lastModified":"2026-11-12T18:17:37.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126920","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:25:31.953024Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:22.527","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/581903854"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126921.json b/data/2026/CVE-2026-126921.json index 273e490651..7735a2c7c4 100644 --- a/data/2026/CVE-2026-126921.json +++ b/data/2026/CVE-2026-126921.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126921","lastModified":"2026-11-11T23:17:22.767","metrics":{},"published":"2026-11-11T23:17:22.663","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580869107"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126921","lastModified":"2026-11-12T17:17:42.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126921","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:03:33.739255Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:22.663","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580869107"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126922.json b/data/2026/CVE-2026-126922.json index 5819644a32..7efe216bac 100644 --- a/data/2026/CVE-2026-126922.json +++ b/data/2026/CVE-2026-126922.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126922","lastModified":"2026-11-11T23:17:22.900","metrics":{},"published":"2026-11-11T23:17:22.800","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577341943"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126922","lastModified":"2026-11-12T18:17:38.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126922","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:30:20.895084Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:22.800","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577341943"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126932.json b/data/2026/CVE-2026-126932.json index 0d34f7a099..8ef46a263f 100644 --- a/data/2026/CVE-2026-126932.json +++ b/data/2026/CVE-2026-126932.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/diced/zipline","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.8.0","status":"affected","version":"4.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type."}],"id":"CVE-2026-126932","lastModified":"2026-11-11T23:17:22.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T23:17:22.943","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/user/files/%5Bid%5D/index.ts#L96"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/commit/fc8e886ca841b86a3f677cd7dac1bf9a5bd45b2c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/releases/tag/v4.8.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-rgxm-54cf-whf7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-4.6.2-before-4.8.0-disabled-mime-type-policy-bypass-via-file-metadata-update"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/diced/zipline","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.8.0","status":"affected","version":"4.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type."}],"id":"CVE-2026-126932","lastModified":"2026-11-12T18:17:38.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126932","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:32.700092Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:22.943","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/user/files/%5Bid%5D/index.ts#L96"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/commit/fc8e886ca841b86a3f677cd7dac1bf9a5bd45b2c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/releases/tag/v4.8.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-rgxm-54cf-whf7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-4.6.2-before-4.8.0-disabled-mime-type-policy-bypass-via-file-metadata-update"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126957.json b/data/2026/CVE-2026-126957.json index 973245a6a2..0d81f9ba59 100644 --- a/data/2026/CVE-2026-126957.json +++ b/data/2026/CVE-2026-126957.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"Zephyr","product":"Zephyr","repo":"https://github.com/zephyrproject-rtos/zephyr","vendor":"zephyrproject-rtos","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"*","versionType":"git"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected."}],"id":"CVE-2026-126957","lastModified":"2026-11-12T03:17:11.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-12T03:17:11.617","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cvv6-5f6x-87qf"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-191"},{"lang":"en","value":"CWE-200"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"Zephyr","product":"Zephyr","repo":"https://github.com/zephyrproject-rtos/zephyr","vendor":"zephyrproject-rtos","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"*","versionType":"git"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected."}],"id":"CVE-2026-126957","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-12T03:17:11.617","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cvv6-5f6x-87qf"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-191"},{"lang":"en","value":"CWE-200"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126994.json b/data/2026/CVE-2026-126994.json index 05b2e1c103..ac3865f205 100644 --- a/data/2026/CVE-2026-126994.json +++ b/data/2026/CVE-2026-126994.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:braindecode:braindecode:*:*:*:*:*:*:*:*"],"modules":["Model Config Deserialization"],"product":"braindecode","vendor":"n/a","versions":[{"status":"affected","version":"1.8.0"},{"status":"affected","version":"1.8.1"},{"status":"unaffected","version":"2.0.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Such manipulation of the argument Activation leads to use of externally-controlled input to select classes or code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. The affected component should be upgraded."}],"id":"CVE-2026-126994","lastModified":"2026-11-12T13:17:15.877","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-12T13:17:15.690","references":[{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/issues/1441"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/pull/1494"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/releases/tag/v2.0.0"},{"source":"cna@vuldb.com","url":"https://github.com/user-attachments/files/33599402/poc.zip"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-126994"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040635"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436293"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436293/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-470"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:braindecode:braindecode:*:*:*:*:*:*:*:*"],"modules":["Model Config Deserialization"],"product":"braindecode","vendor":"n/a","versions":[{"status":"affected","version":"1.8.0"},{"status":"affected","version":"1.8.1"},{"status":"unaffected","version":"2.0.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Such manipulation of the argument Activation leads to use of externally-controlled input to select classes or code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. The affected component should be upgraded."}],"id":"CVE-2026-126994","lastModified":"2026-11-12T18:17:38.663","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126994","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:57:29.399155Z","version":"2.0.3"}}]},"published":"2026-11-12T13:17:15.690","references":[{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/issues/1441"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/pull/1494"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/releases/tag/v2.0.0"},{"source":"cna@vuldb.com","url":"https://github.com/user-attachments/files/33599402/poc.zip"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-126994"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040635"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436293"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436293/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-470"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126998.json b/data/2026/CVE-2026-126998.json index 30d8c7eac1..bf498e4705 100644 --- a/data/2026/CVE-2026-126998.json +++ b/data/2026/CVE-2026-126998.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*"],"modules":["Authentication Filter"],"product":"JeecgBoot","vendor":"n/a","versions":[{"status":"affected","version":"3.9.0"},{"status":"affected","version":"3.9.1"},{"status":"affected","version":"3.9.2"},{"status":"affected","version":"3.9.3"},{"status":"affected","version":"3.9.4"},{"status":"affected","version":"3.9.5"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-126998","lastModified":"2026-11-12T15:17:49.823","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-12T15:17:49.497","references":[{"source":"cna@vuldb.com","url":"https://github.com/dingpotian/cve-vul/blob/main/jeecgboot/advisory-02-openapi-options-auth-bypass.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-126998"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040929"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436297"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436297/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*"],"modules":["Authentication Filter"],"product":"JeecgBoot","vendor":"n/a","versions":[{"status":"affected","version":"3.9.0"},{"status":"affected","version":"3.9.1"},{"status":"affected","version":"3.9.2"},{"status":"affected","version":"3.9.3"},{"status":"affected","version":"3.9.4"},{"status":"affected","version":"3.9.5"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-126998","lastModified":"2026-11-12T18:17:38.993","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126998","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:57:32.059850Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:49.497","references":[{"source":"cna@vuldb.com","url":"https://github.com/dingpotian/cve-vul/blob/main/jeecgboot/advisory-02-openapi-options-auth-bypass.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-126998"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040929"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436297"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436297/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127029.json b/data/2026/CVE-2026-127029.json new file mode 100644 index 0000000000..782275636a --- /dev/null +++ b/data/2026/CVE-2026-127029.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"freeradius","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"freeradius:3.0/freeradius","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS)."}],"id":"CVE-2026-127029","lastModified":"2026-11-12T17:17:43.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T17:17:42.970","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-127029"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572339"},{"source":"secalert@redhat.com","url":"https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"},{"source":"secalert@redhat.com","url":"https://github.com/FreeRADIUS/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-127030.json b/data/2026/CVE-2026-127030.json new file mode 100644 index 0000000000..34f3edcbca --- /dev/null +++ b/data/2026/CVE-2026-127030.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"freeradius","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"freeradius:3.0/freeradius","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS)."}],"id":"CVE-2026-127030","lastModified":"2026-11-12T17:17:43.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T17:17:43.150","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-127030"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572340"},{"source":"secalert@redhat.com","url":"https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"},{"source":"secalert@redhat.com","url":"https://github.com/FreeRADIUS/freeradius-server/commit/a5d09dad528d7a3a3c4c01158716ab85a12e09ef"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-127050.json b/data/2026/CVE-2026-127050.json index 682de32e1b..dc52f45c7e 100644 --- a/data/2026/CVE-2026-127050.json +++ b/data/2026/CVE-2026-127050.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Backup Migration","vendor":"inisev","versions":[{"lessThan":"2.1.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip archive with entry names containing \"..\" sequences, which PclZip's extract() processes without the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, writing a PHP file outside the intended extraction directory into the web-servable tree to achieve remote code execution."}],"id":"CVE-2026-127050","lastModified":"2026-11-12T13:17:16.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T13:17:16.010","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/backup-backup/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/backup-migration-before-path-traversal-via-pclzip-restore-fallback"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Backup Migration","vendor":"inisev","versions":[{"lessThan":"2.1.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip archive with entry names containing \"..\" sequences, which PclZip's extract() processes without the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, writing a PHP file outside the intended extraction directory into the web-servable tree to achieve remote code execution."}],"id":"CVE-2026-127050","lastModified":"2026-11-12T18:17:39.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127050","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:31:27.321499Z","version":"2.0.3"}}]},"published":"2026-11-12T13:17:16.010","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/backup-backup/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/backup-migration-before-path-traversal-via-pclzip-restore-fallback"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127056.json b/data/2026/CVE-2026-127056.json index c0d0aae02b..362a23af5a 100644 --- a/data/2026/CVE-2026-127056.json +++ b/data/2026/CVE-2026-127056.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/papaparse","product":"PapaParse","repo":"https://github.com/mholt/PapaParse","vendor":"mholt","versions":[{"lessThan":"5.7.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab."}],"id":"CVE-2026-127056","lastModified":"2026-11-12T13:17:16.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T13:17:16.177","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/mholt/PapaParse/commit/a50fe19aae08b966de444119333fe4a8b7aa6b2f"},{"source":"disclosure@vulncheck.com","url":"https://www.npmjs.com/package/papaparse"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/papaparse-before-quadratic-time-parsing-dos-via-indexof-scan"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/papaparse","product":"PapaParse","repo":"https://github.com/mholt/PapaParse","vendor":"mholt","versions":[{"lessThan":"5.7.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab."}],"id":"CVE-2026-127056","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T13:17:16.177","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/mholt/PapaParse/commit/a50fe19aae08b966de444119333fe4a8b7aa6b2f"},{"source":"disclosure@vulncheck.com","url":"https://www.npmjs.com/package/papaparse"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/papaparse-before-quadratic-time-parsing-dos-via-indexof-scan"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-127063.json b/data/2026/CVE-2026-127063.json new file mode 100644 index 0000000000..da7b2c9e69 --- /dev/null +++ b/data/2026/CVE-2026-127063.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["ScreenConnect extension API"],"product":"RMM+","vendor":"DataComm","versions":[{"status":"affected","version":"All extension versions"}]}],"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The\nthird-party RMM+ extension for ConnectWise ScreenConnect uses a static API\nsecret by default. The value can be changed by an administrator; however,\nenvironments retaining the default value may allow unauthorized access to\nextension API functionality, including the ability to send commands to managed\nagents. This issue is specific to the third-party extension and does not affect\nthe ScreenConnect server or client.\n\n\n\n\n\nScope: This issue affects the third-party RMM+\nextension for ConnectWise ScreenConnect. Deployments without the extension are\nnot affected. ScreenConnect server or client software are not impacted."}],"id":"CVE-2026-127063","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127063","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:03:16.134942Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:39.760","references":[{"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","url":"https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-127063"}],"sourceIdentifier":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12708.json b/data/2026/CVE-2026-12708.json index dda0b92214..74b05e10c6 100644 --- a/data/2026/CVE-2026-12708.json +++ b/data/2026/CVE-2026-12708.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"tokio-quiche","repo":"https://github.com/cloudflare/quiche/tree/master/tokio-quiche","vendor":"Cloudflare","versions":[{"lessThanOrEqual":"0.20.1","status":"affected","version":"0.0.1","versionType":"semver"}]}],"source":"cna@cloudflare.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Summary\n\n\nCloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow state. A remote peer can send DATAGRAMs with many distinct identifiers, causing the per-connection flow map and associated channel state to grow without bound.\n\nImpact\n\n\nExploitation can exhaust process memory and cause a denial of service. The vulnerable code is used in both client and server configurations, so either role can be affected by a malicious peer. QUIC DATAGRAM support in tokio-quiche is enabled by default through QuicSettings::enable_dgram; applications can disable it by setting this field to false. The vulnerable HTTP/3 path is reachable only when DATAGRAM support is negotiated with the peer. Core quiche and HTTP/3 deployments without DATAGRAM support are not affected. \n\n\n\n\n\n\nMitigation\n\n\nDisable DATAGRAMs in tokio-quiche’s QuicSettings::enable_dgram.\n\n\n\n\n\n\nRemediation\n\n\nUpgrade to tokio-quiche version 0.23.0 or later. The fixed code creates flow state only for valid DATAGRAM-capable request streams, which are bounded by QUIC’s stream limits. To tolerate packet reordering, servers retain early DATAGRAMs in a bounded, expiring buffer, while clients discard DATAGRAMs for unknown flows."}],"id":"CVE-2026-12708","lastModified":"2026-11-10T14:17:29.980","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@cloudflare.com","type":"Secondary"}]},"published":"2026-11-10T14:17:29.980","references":[{"source":"cna@cloudflare.com","url":"https://github.com/cloudflare/quiche/security/advisories/GHSA-wcm9-jv39-r963"},{"source":"cna@cloudflare.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-12708"}],"sourceIdentifier":"cna@cloudflare.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"cna@cloudflare.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"tokio-quiche","repo":"https://github.com/cloudflare/quiche/tree/master/tokio-quiche","vendor":"Cloudflare","versions":[{"lessThanOrEqual":"0.20.1","status":"affected","version":"0.0.1","versionType":"semver"}]}],"source":"cna@cloudflare.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Summary\n\n\nCloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow state. A remote peer can send DATAGRAMs with many distinct identifiers, causing the per-connection flow map and associated channel state to grow without bound.\n\nImpact\n\n\nExploitation can exhaust process memory and cause a denial of service. The vulnerable code is used in both client and server configurations, so either role can be affected by a malicious peer. QUIC DATAGRAM support in tokio-quiche is enabled by default through QuicSettings::enable_dgram; applications can disable it by setting this field to false. The vulnerable HTTP/3 path is reachable only when DATAGRAM support is negotiated with the peer. Core quiche and HTTP/3 deployments without DATAGRAM support are not affected. \n\n\n\n\n\n\nMitigation\n\n\nDisable DATAGRAMs in tokio-quiche’s QuicSettings::enable_dgram.\n\n\n\n\n\n\nRemediation\n\n\nUpgrade to tokio-quiche version 0.23.0 or later. The fixed code creates flow state only for valid DATAGRAM-capable request streams, which are bounded by QUIC’s stream limits. To tolerate packet reordering, servers retain early DATAGRAMs in a bounded, expiring buffer, while clients discard DATAGRAMs for unknown flows."}],"id":"CVE-2026-12708","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@cloudflare.com","type":"Secondary"}]},"published":"2026-11-10T14:17:29.980","references":[{"source":"cna@cloudflare.com","url":"https://github.com/cloudflare/quiche/security/advisories/GHSA-wcm9-jv39-r963"},{"source":"cna@cloudflare.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-12708"}],"sourceIdentifier":"cna@cloudflare.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"cna@cloudflare.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127099.json b/data/2026/CVE-2026-127099.json new file mode 100644 index 0000000000..8d590cbf23 --- /dev/null +++ b/data/2026/CVE-2026-127099.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized RSA components that passes the configured certificate checks can cause denial of service and corrupt SSH responder memory."}],"id":"CVE-2026-127099","lastModified":"2026-11-12T20:18:34.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127099","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:20:05.637588Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:40.227","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-127099"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572590"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127100.json b/data/2026/CVE-2026-127100.json new file mode 100644 index 0000000000..40a714741a --- /dev/null +++ b/data/2026/CVE-2026-127100.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, terminating the PAM responder and disrupting SSSD-backed authentication."}],"id":"CVE-2026-127100","lastModified":"2026-11-12T18:17:41.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T18:17:40.677","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-127100"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572591"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-127101.json b/data/2026/CVE-2026-127101.json new file mode 100644 index 0000000000..482c16ec25 --- /dev/null +++ b/data/2026/CVE-2026-127101.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"sssd","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication. Repeated crafted requests can sustain the denial of service."}],"id":"CVE-2026-127101","lastModified":"2026-11-12T18:17:41.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T18:17:41.110","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-127101"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572592"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-127109.json b/data/2026/CVE-2026-127109.json index 788164ed17..5c0c1b6727 100644 --- a/data/2026/CVE-2026-127109.json +++ b/data/2026/CVE-2026-127109.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Promzard","vendor":"Promzard","versions":[{"lessThanOrEqual":"4.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted."}],"id":"CVE-2026-127109","lastModified":"2026-11-12T16:19:07.097","metrics":{},"published":"2026-11-12T16:19:07.097","references":[{"source":"cret@cert.org","url":"https://github.com/npm/promzard"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"Promzard","vendor":"Promzard","versions":[{"lessThanOrEqual":"4.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted."}],"id":"CVE-2026-127109","lastModified":"2026-11-12T19:22:01.433","metrics":{},"published":"2026-11-12T16:19:07.097","references":[{"source":"cret@cert.org","url":"https://github.com/npm/promzard"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.kb.cert.org/vuls/id/685399"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-127119.json b/data/2026/CVE-2026-127119.json new file mode 100644 index 0000000000..ddf036e7be --- /dev/null +++ b/data/2026/CVE-2026-127119.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"aws-sdk-pandas","vendor":"AWS","versions":[{"lessThan":"3.18.0","status":"affected","version":"1.1.0","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket.\n\n\n\nTo remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use."}],"id":"CVE-2026-127119","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-12T19:17:03.430","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-181-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/aws/aws-sdk-pandas/releases/tag/3.18.0"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-283"},{"lang":"en","value":"CWE-341"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127120.json b/data/2026/CVE-2026-127120.json new file mode 100644 index 0000000000..e28f7e3370 --- /dev/null +++ b/data/2026/CVE-2026-127120.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:governikus:ausweisapp_mobile:*:*:*:*:*:*:*:*"],"modules":["StartPAOSResponse Handler"],"product":"AusweisApp Mobile","vendor":"Governikus","versions":[{"status":"affected","version":"2.5.0"},{"status":"affected","version":"2.5.1"},{"status":"affected","version":"2.5.2"},{"status":"affected","version":"2.5.3"},{"status":"affected","version":"2.5.4"},{"status":"affected","version":"2.5.5"},{"status":"unaffected","version":"2.6.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Governikus AusweisApp Mobile up to 2.5.5. This impacts an unknown function of the component StartPAOSResponse Handler. Performing a manipulation of the argument ResultMessage results in cross site scripting. The attack can be initiated remotely. Upgrading to version 2.6.0 will fix this issue. Upgrading the affected component is advised. This CVE was requested by the vendor."}],"id":"CVE-2026-127120","lastModified":"2026-11-12T20:18:35.047","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-12T20:18:34.807","references":[{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127120"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1033285"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436402"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436402/cti"},{"source":"cna@vuldb.com","url":"https://www.Governikus.de/loesungen/kundenprojekte/AusweisApp/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}],"source":"cna@vuldb.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-127121.json b/data/2026/CVE-2026-127121.json index 46571bb791..c168ae05cf 100644 --- a/data/2026/CVE-2026-127121.json +++ b/data/2026/CVE-2026-127121.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Alinto/sogo","product":"sogo","repo":"https://github.com/Alinto/sogo","vendor":"Alinto","versions":[{"lessThan":"5.12.13","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signature and an impersonated From address. Attackers can deliver a crafted CMS signedData object containing their own self-signed certificate, which SOGo's UIxMailView stores on the contact card without validating signature authenticity or certificate identity, enabling subsequent encrypted communications to be decrypted with the attacker's private key."}],"id":"CVE-2026-127121","lastModified":"2026-11-12T16:19:07.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T16:19:07.587","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sogo-before-s-mime-certificate-spoofing-via-uixmailview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Alinto/sogo","product":"sogo","repo":"https://github.com/Alinto/sogo","vendor":"Alinto","versions":[{"lessThan":"5.12.13","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signature and an impersonated From address. Attackers can deliver a crafted CMS signedData object containing their own self-signed certificate, which SOGo's UIxMailView stores on the contact card without validating signature authenticity or certificate identity, enabling subsequent encrypted communications to be decrypted with the attacker's private key."}],"id":"CVE-2026-127121","lastModified":"2026-11-12T18:17:41.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127121","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:22.620203Z","version":"2.0.3"}}]},"published":"2026-11-12T16:19:07.587","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sogo-before-s-mime-certificate-spoofing-via-uixmailview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127141.json b/data/2026/CVE-2026-127141.json index 307b6729b1..c3dfaa19f1 100644 --- a/data/2026/CVE-2026-127141.json +++ b/data/2026/CVE-2026-127141.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Alinto/sogo","product":"sogo","repo":"https://github.com/Alinto/sogo","vendor":"Alinto","versions":[{"lessThan":"5.12.13","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can issue concurrent GET requests to the mail view of this account to hold workers indefinitely without an effective timeout, occupying every SOGo worker and denying service to all users for approximately five minutes until the watchdog kills and respawns the stuck workers."}],"id":"CVE-2026-127141","lastModified":"2026-11-12T16:19:08.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T16:19:08.230","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sogo-before-denial-of-service-via-auxiliary-imap-account-greeting-wait"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1088"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Alinto/sogo","product":"sogo","repo":"https://github.com/Alinto/sogo","vendor":"Alinto","versions":[{"lessThan":"5.12.13","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all worker processes by configuring an auxiliary IMAP mail account pointing to a controlled host that accepts a TCP connection but never sends an IMAP greeting response. Attackers can issue concurrent GET requests to the mail view of this account to hold workers indefinitely without an effective timeout, occupying every SOGo worker and denying service to all users for approximately five minutes until the watchdog kills and respawns the stuck workers."}],"id":"CVE-2026-127141","lastModified":"2026-11-12T18:17:41.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127141","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:39.777993Z","version":"2.0.3"}}]},"published":"2026-11-12T16:19:08.230","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sogo-before-denial-of-service-via-auxiliary-imap-account-greeting-wait"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1088"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127202.json b/data/2026/CVE-2026-127202.json new file mode 100644 index 0000000000..e0c7772b7b --- /dev/null +++ b/data/2026/CVE-2026-127202.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/mlflow","product":"mlflow","repo":"https://github.com/mlflow/mlflow","vendor":"mlflow","versions":[{"lessThan":"3.18.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious model_id parameter to the log outputs API. Attackers can exploit the unvalidated model_id containing ../ sequences via the POST /api/3.0/mlflow/runs/outputs endpoint to create directories and write a meta.yaml file at arbitrary filesystem locations, limited only by the server account's permissions. FileStore was the default backend before 3.7.0 and is opt-in afterward through MLFLOW_ALLOW_FILE_STORE."}],"id":"CVE-2026-127202","lastModified":"2026-11-12T17:17:43.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T17:17:43.450","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/mlflow/mlflow/commit/ab5fc795eedc22348253cf687818cf2a16c15282"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mlflow/mlflow/pull/27131"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mlflow/mlflow/releases/tag/v3.18.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/mlflow-path-traversal-via-model-id-in-log-outputs-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-127203.json b/data/2026/CVE-2026-127203.json new file mode 100644 index 0000000000..d1296dc25c --- /dev/null +++ b/data/2026/CVE-2026-127203.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/AppFlowy-IO/AppFlowy-Cloud","product":"AppFlowy-Cloud","repo":"https://github.com/AppFlowy-IO/AppFlowy-Cloud","vendor":"AppFlowy-IO","versions":[{"lessThanOrEqual":"0.9.64","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace members to upload blobs with unvalidated Content-Type values that are later served inline without a Content-Disposition header or authentication on the retrieval route. Attackers can upload a text/html or image/svg+xml blob via put_blob_handler, which is then rendered as an active same-origin document through the unauthenticated get_blob_handler endpoint and cached immutably for one year, enabling persistent script execution against any visitor who accesses the URL."}],"id":"CVE-2026-127203","lastModified":"2026-11-12T17:17:43.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T17:17:43.653","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/mtholmquist/9b9683104fc3b5d78a488c06a6674e5c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/appflowy-cloud-stored-xss-via-blob-upload-content-type"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-127204.json b/data/2026/CVE-2026-127204.json new file mode 100644 index 0000000000..5f99f114b3 --- /dev/null +++ b/data/2026/CVE-2026-127204.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payment Gateway for PayPal Pro, PayPal Checkout & Subscriptions for WooCommerce","vendor":"wp.insider","versions":[{"lessThan":"4.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attackers to mark unpaid orders as paid by exploiting the pp_capture_order AJAX handler, which is gated only by a public checkout nonce and fails to properly validate the PayPal capture response status. Attackers can supply a valid _paypal_order_id to trigger payment_complete() without verifying the capture status or amount, causing the store to fulfill goods or services that were never paid for and resulting in direct financial loss to the merchant."}],"id":"CVE-2026-127204","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T18:17:42.423","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/woocommerce-paypal-pro-payment-gateway/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/woocommerce-paypal-pro-payment-gateway-payment-bypass-via-pp-capture-order"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-127235.json b/data/2026/CVE-2026-127235.json new file mode 100644 index 0000000000..fa67f6fdc6 --- /dev/null +++ b/data/2026/CVE-2026-127235.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Meridian","repo":"https://github.com/OpenNMS","vendor":"The OpenNMS Group","versions":[{"lessThan":"2024.3.15","status":"affected","version":"2024.1.0","versionType":"maven"},{"lessThan":"2025.0.12","status":"affected","version":"2025.0.0","versionType":"maven"},{"lessThan":"2026.0.2","status":"affected","version":"2026.0.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"Horizon","repo":"https://github.com/OpenNMS","vendor":"The OpenNMS Group","versions":[{"lessThan":"36.0.6","status":"affected","version":"36.0.0","versionType":"maven"}]}],"source":"security@opennms.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. Several web UI pages copy request parameter values into the HTML response without correct contextual output encoding. A remote attacker can craft a link that runs arbitrary JavaScript in the OpenNMS origin when an authenticated user opens it. The script runs in the victim's browser with the victim's session, so the attacker can read page data and send same-origin requests as the victim. The fix encodes the affected request values. On pages that use AngularJS, the fix also stops client-side template evaluation of the reflected values.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet."}],"id":"CVE-2026-127235","lastModified":"2026-11-12T19:17:03.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security@opennms.com","type":"Secondary"}]},"published":"2026-11-12T19:17:03.583","references":[{"source":"security@opennms.com","url":"https://github.com/OpenNMS/opennms/pull/9066"}],"sourceIdentifier":"security@opennms.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@opennms.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127236.json b/data/2026/CVE-2026-127236.json new file mode 100644 index 0000000000..05b1883372 --- /dev/null +++ b/data/2026/CVE-2026-127236.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Meridian","repo":"https://github.com/OpenNMS","vendor":"The OpenNMS Group","versions":[{"lessThan":"2024.3.15","status":"affected","version":"2024.1.0","versionType":"maven"},{"lessThan":"2025.0.12","status":"affected","version":"2025.0.0","versionType":"maven"},{"lessThan":"2026.0.2","status":"affected","version":"2026.0.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"Horizon","repo":"https://github.com/OpenNMS","vendor":"The OpenNMS Group","versions":[{"lessThan":"36.0.6","status":"affected","version":"36.0.0","versionType":"maven"}]}],"source":"security@opennms.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Meridian and Horizon. The ad-hoc graph endpoint (GET /graph/graph.png?adhoc=true) copies request parameters into the rrdtool command line without validation. A low-privileged authenticated user (ROLE_USER or ROLE_DASHBOARD) can insert extra rrdtool arguments. An injected --daemon argument makes the server connect to an attacker-chosen address, which is a server-side request forgery. An injected DEF statement reads a local RRD file by absolute path. The command runs through exec with an argument array and no shell, so arbitrary operating system command execution is not possible. The fix validates the ad-hoc graph parameters against allowlists.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet."}],"id":"CVE-2026-127236","lastModified":"2026-11-12T19:17:03.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security@opennms.com","type":"Secondary"}]},"published":"2026-11-12T19:17:03.723","references":[{"source":"security@opennms.com","url":"https://github.com/OpenNMS/opennms/pull/9065"}],"sourceIdentifier":"security@opennms.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"security@opennms.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12963.json b/data/2026/CVE-2026-12963.json index c1cc7d080f..9bc85195e1 100644 --- a/data/2026/CVE-2026-12963.json +++ b/data/2026/CVE-2026-12963.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"AXIS Camera Station 5","vendor":"Axis Communications AB","versions":[{"lessThan":"5.59","status":"affected","version":"5.0","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server."}],"id":"CVE-2026-12963","lastModified":"2026-11-10T06:17:08.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":3.7,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:08.330","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/c5/ba/15/cve-2026-12963pdf-en-US-561249.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"AXIS Camera Station 5","vendor":"Axis Communications AB","versions":[{"lessThan":"5.59","status":"affected","version":"5.0","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server."}],"id":"CVE-2026-12963","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":3.7,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12963","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:41:39.596200Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:08.330","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/c5/ba/15/cve-2026-12963pdf-en-US-561249.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12964.json b/data/2026/CVE-2026-12964.json index b127533bf5..185b193b01 100644 --- a/data/2026/CVE-2026-12964.json +++ b/data/2026/CVE-2026-12964.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.6","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges."}],"id":"CVE-2026-12964","lastModified":"2026-11-10T06:17:08.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:08.453","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/50/3b/39/cve-2026-12964pdf-en-US-561250.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.6","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges."}],"id":"CVE-2026-12964","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12964","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:42:26.139758Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:08.453","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/50/3b/39/cve-2026-12964pdf-en-US-561250.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-13269.json b/data/2026/CVE-2026-13269.json index f2c3c55c90..e05d842684 100644 --- a/data/2026/CVE-2026-13269.json +++ b/data/2026/CVE-2026-13269.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"NetVault Backup","vendor":"Quest","versions":[{"status":"affected","version":"14.0.2.4"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the StnzCreateKey function. The issue results from the lack of proper validation of user-supplied data, which can result in a numeric truncation error before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28743."}],"id":"CVE-2026-13269","lastModified":"2026-11-12T03:17:11.777","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:11.777","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-888/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-197"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"NetVault Backup","vendor":"Quest","versions":[{"status":"affected","version":"14.0.2.4"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the StnzCreateKey function. The issue results from the lack of proper validation of user-supplied data, which can result in a numeric truncation error before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28743."}],"id":"CVE-2026-13269","lastModified":"2026-11-12T18:48:01.617","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:11.777","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-888/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-197"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-13270.json b/data/2026/CVE-2026-13270.json index d52ae9a9d3..0e21deda25 100644 --- a/data/2026/CVE-2026-13270.json +++ b/data/2026/CVE-2026-13270.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"NetVault Backup","vendor":"Quest","versions":[{"status":"affected","version":"14.0.2.4"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the nvpmgr service, which listens on UDP port 20031 by default. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28744."}],"id":"CVE-2026-13270","lastModified":"2026-11-12T03:17:11.913","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:11.913","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-889/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"NetVault Backup","vendor":"Quest","versions":[{"status":"affected","version":"14.0.2.4"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the nvpmgr service, which listens on UDP port 20031 by default. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before allocating a buffer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-28744."}],"id":"CVE-2026-13270","lastModified":"2026-11-12T18:48:01.617","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:11.913","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-889/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-13312.json b/data/2026/CVE-2026-13312.json index e1e49405b0..f273f44430 100644 --- a/data/2026/CVE-2026-13312.json +++ b/data/2026/CVE-2026-13312.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.17","status":"affected","version":"6.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"AXIS Camera Station 5","vendor":"Axis Communications AB","versions":[{"lessThan":"5.59 SR2","status":"affected","version":"5.0","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability that could allow an attacker to compromise a system."}],"id":"CVE-2026-13312","lastModified":"2026-11-12T14:17:29.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:08.587","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/permalink/289342/cve-2026-13312pdf-en-US_289342.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.17","status":"affected","version":"6.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"AXIS Camera Station 5","vendor":"Axis Communications AB","versions":[{"lessThan":"5.59 SR2","status":"affected","version":"5.0","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability that could allow an attacker to compromise a system."}],"id":"CVE-2026-13312","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-13312","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:39:28.445713Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:08.587","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/permalink/289342/cve-2026-13312pdf-en-US_289342.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-13387.json b/data/2026/CVE-2026-13387.json index 4df0d3c888..0da32859b2 100644 --- a/data/2026/CVE-2026-13387.json +++ b/data/2026/CVE-2026-13387.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.0","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions."}],"id":"CVE-2026-13387","lastModified":"2026-11-10T06:17:08.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:08.717","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/d7/64/a2/cve-2026-13387pdf-en-US-561252.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.0","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions."}],"id":"CVE-2026-13387","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-13387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:40:21.530861Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:08.717","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/d7/64/a2/cve-2026-13387pdf-en-US-561252.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-13409.json b/data/2026/CVE-2026-13409.json index 108ada73db..e453f51f5b 100644 --- a/data/2026/CVE-2026-13409.json +++ b/data/2026/CVE-2026-13409.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"13.0.31","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"12.11.84","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"11.11.218","status":"affected","version":"11.0.0","versionType":"semver"},{"lessThan":"10.12.345","status":"affected","version":"10.0.0","versionType":"semver"},{"lessThan":"9.80.148","status":"affected","version":"9.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account."}],"id":"CVE-2026-13409","lastModified":"2026-11-10T06:17:08.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:08.840","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/ef/b3/81/cve-2026-13409pdf-en-US-561255.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"13.0.31","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"12.11.84","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"11.11.218","status":"affected","version":"11.0.0","versionType":"semver"},{"lessThan":"10.12.345","status":"affected","version":"10.0.0","versionType":"semver"},{"lessThan":"9.80.148","status":"affected","version":"9.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account."}],"id":"CVE-2026-13409","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-13409","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:10:04.582284Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:08.840","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/ef/b3/81/cve-2026-13409pdf-en-US-561255.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-13656.json b/data/2026/CVE-2026-13656.json index 8243bda39a..034e9b1373 100644 --- a/data/2026/CVE-2026-13656.json +++ b/data/2026/CVE-2026-13656.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files."}],"id":"CVE-2026-13656","lastModified":"2026-11-12T04:17:18.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.217","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files."}],"id":"CVE-2026-13656","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.217","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-13672.json b/data/2026/CVE-2026-13672.json index a3c7aaeea4..1638f1c8f5 100644 --- a/data/2026/CVE-2026-13672.json +++ b/data/2026/CVE-2026-13672.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-13672","lastModified":"2026-11-12T04:17:18.343","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.343","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-13672","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.343","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-13721.json b/data/2026/CVE-2026-13721.json index afbab9a754..03a0807e2a 100644 --- a/data/2026/CVE-2026-13721.json +++ b/data/2026/CVE-2026-13721.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization)."}],"id":"CVE-2026-13721","lastModified":"2026-11-11T15:17:22.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:22.700","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-13721"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-696"},{"lang":"en","value":"CWE-863"}],"source":"security@grafana.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization)."}],"id":"CVE-2026-13721","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:22.700","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-13721"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-696"},{"lang":"en","value":"CWE-863"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-13764.json b/data/2026/CVE-2026-13764.json index 361c56a68d..a63cd7aa2b 100644 --- a/data/2026/CVE-2026-13764.json +++ b/data/2026/CVE-2026-13764.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Masterstudy - Education WordPress Theme","vendor":"StylemixThemes","versions":[{"lessThanOrEqual":"4.8.151","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by setting the `stm_developer_access_token` transient and using the developer access auto-login flow to obtain administrator session cookies."}],"id":"CVE-2026-13764","lastModified":"2026-11-12T12:18:23.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-12T12:18:23.753","references":[{"source":"security@wordfence.com","url":"https://docs.stylemixthemes.com/masterstudy-theme-documentation/extra-materials/changelog"},{"source":"security@wordfence.com","url":"https://themeforest.net/item/masterstudy-education-center-wordpress-theme/12170274"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec898f73-d275-4624-911b-89d9a945ff92?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@wordfence.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Masterstudy - Education WordPress Theme","vendor":"StylemixThemes","versions":[{"lessThanOrEqual":"4.8.151","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by setting the `stm_developer_access_token` transient and using the developer access auto-login flow to obtain administrator session cookies."}],"id":"CVE-2026-13764","lastModified":"2026-11-12T18:17:45.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-13764","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:31:24.830659Z","version":"2.0.3"}}]},"published":"2026-11-12T12:18:23.753","references":[{"source":"security@wordfence.com","url":"https://docs.stylemixthemes.com/masterstudy-theme-documentation/extra-materials/changelog"},{"source":"security@wordfence.com","url":"https://themeforest.net/item/masterstudy-education-center-wordpress-theme/12170274"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec898f73-d275-4624-911b-89d9a945ff92?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@wordfence.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-14242.json b/data/2026/CVE-2026-14242.json index 71a4448688..4d16e7f4b8 100644 --- a/data/2026/CVE-2026-14242.json +++ b/data/2026/CVE-2026-14242.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization)."}],"id":"CVE-2026-14242","lastModified":"2026-11-11T15:17:22.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:22.850","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-14242"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-424"},{"lang":"en","value":"CWE-862"}],"source":"security@grafana.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThanOrEqual":"13.1.9","status":"affected","version":"13.1.0","versionType":"semver"},{"lessThanOrEqual":"13.2.5","status":"affected","version":"13.2.0","versionType":"semver"},{"lessThanOrEqual":"13.3.0","status":"affected","version":"13.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization)."}],"id":"CVE-2026-14242","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:22.850","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-14242"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-424"},{"lang":"en","value":"CWE-862"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-14542.json b/data/2026/CVE-2026-14542.json index c439cb76d9..0c5b8ea9e6 100644 --- a/data/2026/CVE-2026-14542.json +++ b/data/2026/CVE-2026-14542.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"13.0.83","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"12.11.123","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"11.11.228","status":"affected","version":"11.0.0","versionType":"semver"},{"lessThan":"10.12.352","status":"affected","version":"10.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege\nescalation. This flaw can only be exploited after authenticating with an admin-privileged service\naccount."}],"id":"CVE-2026-14542","lastModified":"2026-11-10T06:17:08.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:08.970","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/12/1f/f8/cve-2026-14542pdf-en-US-561256.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"13.0.83","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"12.11.123","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"11.11.228","status":"affected","version":"11.0.0","versionType":"semver"},{"lessThan":"10.12.352","status":"affected","version":"10.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege\nescalation. This flaw can only be exploited after authenticating with an admin-privileged service\naccount."}],"id":"CVE-2026-14542","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-14542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:10:58.568541Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:08.970","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/12/1f/f8/cve-2026-14542pdf-en-US-561256.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-14543.json b/data/2026/CVE-2026-14543.json index 47b4cea08b..cdfd84e100 100644 --- a/data/2026/CVE-2026-14543.json +++ b/data/2026/CVE-2026-14543.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"13.0.42","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"12.11.84","status":"affected","version":"12.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account."}],"id":"CVE-2026-14543","lastModified":"2026-11-10T06:17:09.093","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":3.9,"baseSeverity":"LOW","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.3,"impactScore":3.6,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:09.093","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/cd/92/6b/cve-2026-14543pdf-en-US-561257.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"},{"lang":"en","value":"CWE-1287"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"13.0.42","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"12.11.84","status":"affected","version":"12.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account."}],"id":"CVE-2026-14543","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":3.9,"baseSeverity":"LOW","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.3,"impactScore":3.6,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-14543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:11:36.936658Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:09.093","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/cd/92/6b/cve-2026-14543pdf-en-US-561257.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"},{"lang":"en","value":"CWE-1287"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-14661.json b/data/2026/CVE-2026-14661.json index b1e1a5761f..0d0e0557c2 100644 --- a/data/2026/CVE-2026-14661.json +++ b/data/2026/CVE-2026-14661.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This \"sslkeylogfile\" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."}],"id":"CVE-2026-14661","lastModified":"2026-11-12T15:17:49.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:49.890","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-14661/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This \"sslkeylogfile\" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."}],"id":"CVE-2026-14661","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:49.890","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-14661/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-14918.json b/data/2026/CVE-2026-14918.json index 98496b3168..231b2b1a69 100644 --- a/data/2026/CVE-2026-14918.json +++ b/data/2026/CVE-2026-14918.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Signed Video Framework","vendor":"Axis Communications AB","versions":[{"lessThan":"2.3.7","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Signed media verifier","vendor":"Axis Communications AB","versions":[{"lessThan":"1.0.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Axis File Player","vendor":"Axis Communications AB","versions":[{"lessThan":"3.1.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected."}],"id":"CVE-2026-14918","lastModified":"2026-11-10T06:17:09.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:09.233","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/3b/4f/06/cve-2026-14918pdf-en-US-561258.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Signed Video Framework","vendor":"Axis Communications AB","versions":[{"lessThan":"2.3.7","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Signed media verifier","vendor":"Axis Communications AB","versions":[{"lessThan":"1.0.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Axis File Player","vendor":"Axis Communications AB","versions":[{"lessThan":"3.1.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected."}],"id":"CVE-2026-14918","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-14918","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:38:41.770735Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:09.233","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/3b/4f/06/cve-2026-14918pdf-en-US-561258.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-15198.json b/data/2026/CVE-2026-15198.json index 73845e9830..49fdb5cfcf 100644 --- a/data/2026/CVE-2026-15198.json +++ b/data/2026/CVE-2026-15198.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files and conduct limited denial-of-service attacks."}],"id":"CVE-2026-15198","lastModified":"2026-11-12T04:17:18.473","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.473","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files and conduct limited denial-of-service attacks."}],"id":"CVE-2026-15198","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.473","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-15201.json b/data/2026/CVE-2026-15201.json index 2a08fba4fe..b4075bf654 100644 --- a/data/2026/CVE-2026-15201.json +++ b/data/2026/CVE-2026-15201.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission."}],"id":"CVE-2026-15201","lastModified":"2026-11-12T04:17:18.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.603","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission."}],"id":"CVE-2026-15201","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.603","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-16052.json b/data/2026/CVE-2026-16052.json new file mode 100644 index 0000000000..45da1e1093 --- /dev/null +++ b/data/2026/CVE-2026-16052.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["http","http.cookies"],"product":"CPython","repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","versions":[{"lessThan":"3.16.0","status":"affected","version":"0","versionType":"python"}]}],"source":"cna@python.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The http.cookies.Morsel class allows separator semicolons in attribute\nvalues\nand includes them verbatim in all output formats. An attacker who can\ncontrol\nthese values could use this to relax the cookie's Domain or SameSite\nrestrictions."}],"id":"CVE-2026-16052","lastModified":"2026-11-12T17:17:44.353","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@python.org","type":"Secondary"}]},"published":"2026-11-12T17:17:44.237","references":[{"source":"cna@python.org","url":"https://github.com/python/cpython/issues/161707"},{"source":"cna@python.org","url":"https://github.com/python/cpython/pull/161711"},{"source":"cna@python.org","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/IZL4QUFV7PKGT2JYSU2DCBMLTWYJDGKZ/"}],"sourceIdentifier":"cna@python.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"cna@python.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-16237.json b/data/2026/CVE-2026-16237.json index d5abd3c80b..e5c9e19653 100644 --- a/data/2026/CVE-2026-16237.json +++ b/data/2026/CVE-2026-16237.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-16237","lastModified":"2026-11-12T15:17:50.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:50.030","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-16237/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-16237","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:50.030","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-16237/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-16240.json b/data/2026/CVE-2026-16240.json index 6d0c0c880e..15c5bd3759 100644 --- a/data/2026/CVE-2026-16240.json +++ b/data/2026/CVE-2026-16240.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-16240","lastModified":"2026-11-12T15:17:50.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:50.170","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-16240/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-16240","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:50.170","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-16240/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-16283.json b/data/2026/CVE-2026-16283.json index 1e656432a7..bd39627430 100644 --- a/data/2026/CVE-2026-16283.json +++ b/data/2026/CVE-2026-16283.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"oPanel","vendor":"Osbil Technology Ltd.Osbil Technology Ltd.","versions":[{"lessThan":"1.20.66","status":"affected","version":"0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection.\n\nThis issue affects oPanel: before 1.20.66."}],"id":"CVE-2026-16283","lastModified":"2026-11-10T16:24:34.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-09T14:17:16.700","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1488"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"oPanel","vendor":"Osbil Technology Ltd.Osbil Technology Ltd.","versions":[{"lessThan":"1.20.66","status":"affected","version":"0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection.\n\nThis issue affects oPanel: before 1.20.66."}],"id":"CVE-2026-16283","lastModified":"2026-11-12T17:17:44.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-16283","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:19:28.942488Z","version":"2.0.3"}}]},"published":"2026-11-09T14:17:16.700","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1488"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"iletisim@usom.gov.tr","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-16550.json b/data/2026/CVE-2026-16550.json index 912be8e611..837463a7df 100644 --- a/data/2026/CVE-2026-16550.json +++ b/data/2026/CVE-2026-16550.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files."}],"id":"CVE-2026-16550","lastModified":"2026-11-12T04:17:18.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.730","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files."}],"id":"CVE-2026-16550","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.730","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-16697.json b/data/2026/CVE-2026-16697.json index 9ba1cb2cdf..5d8f270697 100644 --- a/data/2026/CVE-2026-16697.json +++ b/data/2026/CVE-2026-16697.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op940.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op940.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op940.a2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op940.a2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op910.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op910.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op910.95:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op910.95.0:*:*:*:*:*:*:*"],"product":"OPENBMC","vendor":"IBM","versions":[{"lessThanOrEqual":"FW1060.81","status":"affected","version":"FW1060.00","versionType":"semver"},{"lessThanOrEqual":"OP940.A2","status":"affected","version":"OP940.00","versionType":"semver"},{"lessThanOrEqual":"OP910.95","status":"affected","version":"OP910.00","versionType":"semver"}]},{"cpes":["cpe:2.3:a:ibm:power_hardware_management_console:op940.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:power_hardware_management_console:op940.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:power_hardware_management_console:op940.82:*:*:*:*:*:*:*","cpe:2.3:a:ibm:power_hardware_management_console:op940.82.0:*:*:*:*:*:*:*"],"product":"Power Hardware Management Console","vendor":"IBM","versions":[{"lessThanOrEqual":"OP940.82","status":"affected","version":"OP940.00","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and  OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper restriction of excessive computational resources."}],"id":"CVE-2026-16697","lastModified":"2026-11-08T20:17:24.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T20:17:24.323","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294277"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op940.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op940.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op940.a2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op940.a2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op910.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op910.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op910.95:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:op910.95.0:*:*:*:*:*:*:*"],"product":"OPENBMC","vendor":"IBM","versions":[{"lessThanOrEqual":"FW1060.81","status":"affected","version":"FW1060.00","versionType":"semver"},{"lessThanOrEqual":"OP940.A2","status":"affected","version":"OP940.00","versionType":"semver"},{"lessThanOrEqual":"OP910.95","status":"affected","version":"OP910.00","versionType":"semver"}]},{"cpes":["cpe:2.3:a:ibm:power_hardware_management_console:op940.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:power_hardware_management_console:op940.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:power_hardware_management_console:op940.82:*:*:*:*:*:*:*","cpe:2.3:a:ibm:power_hardware_management_console:op940.82.0:*:*:*:*:*:*:*"],"product":"Power Hardware Management Console","vendor":"IBM","versions":[{"lessThanOrEqual":"OP940.82","status":"affected","version":"OP940.00","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and  OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper restriction of excessive computational resources."}],"id":"CVE-2026-16697","lastModified":"2026-11-12T20:18:35.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-16697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:03:09.198264Z","version":"2.0.3"}}]},"published":"2026-11-08T20:17:24.323","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294277"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-17112.json b/data/2026/CVE-2026-17112.json index 9cfa18fffe..b1d9e79477 100644 --- a/data/2026/CVE-2026-17112.json +++ b/data/2026/CVE-2026-17112.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization."}],"id":"CVE-2026-17112","lastModified":"2026-11-08T02:16:59.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:33:15.345420Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:25.040","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization."}],"id":"CVE-2026-17112","lastModified":"2026-11-12T20:35:55.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:33:15.345420Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:25.040","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-17114.json b/data/2026/CVE-2026-17114.json index 77f1238592..9fdc3f0e41 100644 --- a/data/2026/CVE-2026-17114.json +++ b/data/2026/CVE-2026-17114.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information."}],"id":"CVE-2026-17114","lastModified":"2026-11-07T05:18:25.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:25.387","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information."}],"id":"CVE-2026-17114","lastModified":"2026-11-12T20:38:45.727","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17114","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:03:30.240930Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:25.387","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-17117.json b/data/2026/CVE-2026-17117.json index 1ac8fedf4d..89607c8a18 100644 --- a/data/2026/CVE-2026-17117.json +++ b/data/2026/CVE-2026-17117.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution."}],"id":"CVE-2026-17117","lastModified":"2026-11-09T15:17:19.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17117","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T04:55:18.118539Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:25.647","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution."}],"id":"CVE-2026-17117","lastModified":"2026-11-12T20:41:13.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17117","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T04:55:18.118539Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:25.647","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-17278.json b/data/2026/CVE-2026-17278.json index c8dffc1d2e..6fb6c36ebf 100644 --- a/data/2026/CVE-2026-17278.json +++ b/data/2026/CVE-2026-17278.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a trusted party."}],"id":"CVE-2026-17278","lastModified":"2026-11-10T16:53:33.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-11-07T05:18:33.440","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a trusted party."}],"id":"CVE-2026-17278","lastModified":"2026-11-12T17:17:44.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17278","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:37.098471Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:33.440","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-17309.json b/data/2026/CVE-2026-17309.json index 82e81e987c..978e227d7e 100644 --- a/data/2026/CVE-2026-17309.json +++ b/data/2026/CVE-2026-17309.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation."}],"id":"CVE-2026-17309","lastModified":"2026-11-07T05:18:39.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.8,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:39.393","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation."}],"id":"CVE-2026-17309","lastModified":"2026-11-12T17:17:44.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.8,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:35:38.339614Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:39.393","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-17315.json b/data/2026/CVE-2026-17315.json index 795d889410..780cbd34f0 100644 --- a/data/2026/CVE-2026-17315.json +++ b/data/2026/CVE-2026-17315.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs."}],"id":"CVE-2026-17315","lastModified":"2026-11-07T05:18:40.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:40.543","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs."}],"id":"CVE-2026-17315","lastModified":"2026-11-12T17:17:44.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17315","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:32:40.446987Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:40.543","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-17324.json b/data/2026/CVE-2026-17324.json index e0b9dfdd26..539fddb5b3 100644 --- a/data/2026/CVE-2026-17324.json +++ b/data/2026/CVE-2026-17324.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function."}],"id":"CVE-2026-17324","lastModified":"2026-11-07T05:18:42.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.7,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:42.310","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function."}],"id":"CVE-2026-17324","lastModified":"2026-11-12T19:17:03.863","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.7,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17324","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:52:10.961336Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:42.310","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-17329.json b/data/2026/CVE-2026-17329.json index ce2b662ac4..d0b9769800 100644 --- a/data/2026/CVE-2026-17329.json +++ b/data/2026/CVE-2026-17329.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs."}],"id":"CVE-2026-17329","lastModified":"2026-11-07T05:18:43.413","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:43.273","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs."}],"id":"CVE-2026-17329","lastModified":"2026-11-12T17:17:45.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17329","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:33:52.140284Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:43.273","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-17360.json b/data/2026/CVE-2026-17360.json index a790b124e2..1a113cdb30 100644 --- a/data/2026/CVE-2026-17360.json +++ b/data/2026/CVE-2026-17360.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials."}],"id":"CVE-2026-17360","lastModified":"2026-11-07T05:18:48.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:48.197","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials."}],"id":"CVE-2026-17360","lastModified":"2026-11-12T17:17:45.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-17360","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:39:45.786906Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:48.197","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-18128.json b/data/2026/CVE-2026-18128.json index ff315e0603..64b522168e 100644 --- a/data/2026/CVE-2026-18128.json +++ b/data/2026/CVE-2026-18128.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager","vendor":"ivanti","versions":[{"status":"unaffected","version":"2024 SU8"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic."}],"id":"CVE-2026-18128","lastModified":"2026-11-10T16:17:24.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:24.050","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November-2026?language=en_US"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-319"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager","vendor":"ivanti","versions":[{"status":"unaffected","version":"2024 SU8"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic."}],"id":"CVE-2026-18128","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T16:17:24.050","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-November-2026?language=en_US"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-319"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Primary"}]} diff --git a/data/2026/CVE-2026-18379.json b/data/2026/CVE-2026-18379.json new file mode 100644 index 0000000000..10a620fbaa --- /dev/null +++ b/data/2026/CVE-2026-18379.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"yggdrasil-worker-package-manager","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity."}],"id":"CVE-2026-18379","lastModified":"2026-11-12T19:17:04.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T19:17:04.040","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-18379"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546571"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-18447.json b/data/2026/CVE-2026-18447.json index 5f5c6fa67f..66d812bbfe 100644 --- a/data/2026/CVE-2026-18447.json +++ b/data/2026/CVE-2026-18447.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type \"any\". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-18447","lastModified":"2026-11-12T15:17:51.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:51.127","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-18447/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type \"any\". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-18447","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:51.127","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-18447/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-18596.json b/data/2026/CVE-2026-18596.json index d831deebc1..5a1cd807c5 100644 --- a/data/2026/CVE-2026-18596.json +++ b/data/2026/CVE-2026-18596.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with valid user credentials to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-18596","lastModified":"2026-11-12T04:17:18.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.880","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with valid user credentials to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-18596","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:18.880","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-18633.json b/data/2026/CVE-2026-18633.json index 7ae35590a9..878e04ce12 100644 --- a/data/2026/CVE-2026-18633.json +++ b/data/2026/CVE-2026-18633.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct denial-of-service attacks."}],"id":"CVE-2026-18633","lastModified":"2026-11-12T04:17:19.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.007","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-824"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct denial-of-service attacks."}],"id":"CVE-2026-18633","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.007","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-824"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-18767.json b/data/2026/CVE-2026-18767.json index d3f65d89db..ea673ef89f 100644 --- a/data/2026/CVE-2026-18767.json +++ b/data/2026/CVE-2026-18767.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM 3.16.29","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.16.29"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM <3.18.1","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.18.1","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices."}],"id":"CVE-2026-18767","lastModified":"2026-11-12T15:17:51.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-18767","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:59:58.664035Z","version":"2.0.3"}}]},"published":"2026-11-11T09:17:15.133","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-087/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-782"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM 3.16.29","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.16.29"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM <3.18.1","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.18.1","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices."}],"id":"CVE-2026-18767","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-18767","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T14:59:58.664035Z","version":"2.0.3"}}]},"published":"2026-11-11T09:17:15.133","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-087/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-782"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-18768.json b/data/2026/CVE-2026-18768.json index 3389f23022..6f4207d95d 100644 --- a/data/2026/CVE-2026-18768.json +++ b/data/2026/CVE-2026-18768.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM 3.16.29","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.16.29"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM <3.18.1","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.18.1","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices."}],"id":"CVE-2026-18768","lastModified":"2026-11-11T09:17:15.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-11T09:17:15.313","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-087/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-782"}],"source":"info@cert.vde.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM 3.16.29","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.16.29"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM <3.18.1","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.18.1","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices."}],"id":"CVE-2026-18768","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-18768","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:31:09.412187Z","version":"2.0.3"}}]},"published":"2026-11-11T09:17:15.313","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-087/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-782"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-18769.json b/data/2026/CVE-2026-18769.json index 998e5b9854..7a5d5dfe7f 100644 --- a/data/2026/CVE-2026-18769.json +++ b/data/2026/CVE-2026-18769.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM 3.16.29","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.16.29"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM <3.18.1","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.18.1","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices."}],"id":"CVE-2026-18769","lastModified":"2026-11-11T09:17:15.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-11T09:17:15.503","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-087/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-782"}],"source":"info@cert.vde.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x64 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 3.1.0.2364","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.1.0.2364"}]},{"defaultStatus":"unaffected","product":"TcRouter.sys for Windows on x86 <3.1.0.2365","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.1.0.2365","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM 3.16.29","vendor":"Beckhoff Automation","versions":[{"status":"affected","version":"3.16.29"}]},{"defaultStatus":"unaffected","product":"TwinCAT.XAR.Base.KM <3.18.1","vendor":"Beckhoff Automation","versions":[{"lessThan":"3.18.1","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices."}],"id":"CVE-2026-18769","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-11T09:17:15.503","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-087/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-782"}],"source":"info@cert.vde.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-18792.json b/data/2026/CVE-2026-18792.json index 2e8d6ec0a8..af6371eab1 100644 --- a/data/2026/CVE-2026-18792.json +++ b/data/2026/CVE-2026-18792.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-18792","lastModified":"2026-11-12T04:17:19.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.127","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-18792","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.127","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-18838.json b/data/2026/CVE-2026-18838.json index b9936b3a97..aadf2b590a 100644 --- a/data/2026/CVE-2026-18838.json +++ b/data/2026/CVE-2026-18838.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user."}],"id":"CVE-2026-18838","lastModified":"2026-11-07T05:18:59.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:59.803","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user."}],"id":"CVE-2026-18838","lastModified":"2026-11-12T17:17:45.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-18838","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:11.301658Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:59.803","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-18963.json b/data/2026/CVE-2026-18963.json index 4565caa774..4001412121 100644 --- a/data/2026/CVE-2026-18963.json +++ b/data/2026/CVE-2026-18963.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4.15-1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4-23","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4-23","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.4"],"defaultStatus":"unaffected","packageName":"keycloak-services","product":"Red Hat build of Keycloak 26.4.15","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.4"],"defaultStatus":"unaffected","packageName":"rhbk-openshift-rhel9/rhbk-openshift-rhel9","product":"Red Hat build of Keycloak 26.4.15","vendor":"Red Hat"},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.6","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.6.6-1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.6","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.6-12","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.6","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.6-12","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6"],"defaultStatus":"unaffected","packageName":"keycloak-services","product":"Red Hat build of Keycloak 26.6.6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6"],"defaultStatus":"unaffected","packageName":"rhbk-keycloak-rhel9/rhbk-keycloak-rhel9","product":"Red Hat build of Keycloak 26.6.6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6"],"defaultStatus":"unaffected","packageName":"rhbk-openshift-rhel9/rhbk-openshift-rhel9","product":"Red Hat build of Keycloak 26.6.6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"keycloak-services","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"defaultStatus":"affected","packageName":"keycloak-services","product":"Red Hat Single Sign-On 7","vendor":"Red Hat"}],"source":"secalert@redhat.com"},{"affectedData":[{"defaultStatus":"unknown","product":"Industrial Edge Management Cloud","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Industrial Edge Management Pro V1","vendor":"Siemens","versions":[{"lessThan":"V1.15.20","status":"affected","version":"V1.14.9","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Industrial Edge Management Pro V2","vendor":"Siemens","versions":[{"lessThan":"V2.2.2","status":"affected","version":"V2.2.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Industrial Edge Management Virtual","vendor":"Siemens","versions":[{"lessThan":"V2.9.1","status":"affected","version":"V2.6.0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials."}],"id":"CVE-2026-18963","lastModified":"2026-10-23T17:17:21.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-18963","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-20T13:53:38.227092Z","version":"2.0.3"}}]},"published":"2026-08-18T17:16:57.083","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:56519"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:56520"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:56523"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:56524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-18963"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511595"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-503852.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4.15-1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4-23","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.4-23","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.4"],"defaultStatus":"unaffected","packageName":"keycloak-services","product":"Red Hat build of Keycloak 26.4.15","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.4"],"defaultStatus":"unaffected","packageName":"rhbk-openshift-rhel9/rhbk-openshift-rhel9","product":"Red Hat build of Keycloak 26.4.15","vendor":"Red Hat"},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.6","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.6.6-1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.6","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.6-12","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"defaultStatus":"affected","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.6","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.6-12","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6"],"defaultStatus":"unaffected","packageName":"keycloak-services","product":"Red Hat build of Keycloak 26.6.6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6"],"defaultStatus":"unaffected","packageName":"rhbk-keycloak-rhel9/rhbk-keycloak-rhel9","product":"Red Hat build of Keycloak 26.6.6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.6"],"defaultStatus":"unaffected","packageName":"rhbk-openshift-rhel9/rhbk-openshift-rhel9","product":"Red Hat build of Keycloak 26.6.6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6"],"defaultStatus":"unaffected","packageName":"keycloak-services","product":"Red Hat Single Sign-On 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 7","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.21-1.redhat_00001.1.el7sso","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"],"defaultStatus":"affected","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7.6 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:18.0.21-1.redhat_00001.1.el9sso","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"keycloak-services","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"}],"source":"secalert@redhat.com"},{"affectedData":[{"defaultStatus":"unknown","product":"Industrial Edge Management Cloud","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Industrial Edge Management Pro V1","vendor":"Siemens","versions":[{"lessThan":"V1.15.20","status":"affected","version":"V1.14.9","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Industrial Edge Management Pro V2","vendor":"Siemens","versions":[{"lessThan":"V2.2.2","status":"affected","version":"V2.2.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Industrial Edge Management Virtual","vendor":"Siemens","versions":[{"lessThan":"V2.9.1","status":"affected","version":"V2.6.0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials."}],"id":"CVE-2026-18963","lastModified":"2026-11-12T19:17:04.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-18963","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-20T13:53:38.227092Z","version":"2.0.3"}}]},"published":"2026-08-18T17:16:57.083","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:56519"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:56520"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:56523"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:56524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99763"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99764"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99766"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-18963"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511595"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-503852.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-19048.json b/data/2026/CVE-2026-19048.json index 074dba28f2..168a5a61e7 100644 --- a/data/2026/CVE-2026-19048.json +++ b/data/2026/CVE-2026-19048.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-19048","lastModified":"2026-11-12T04:17:19.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.253","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-19048","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.253","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-19414.json b/data/2026/CVE-2026-19414.json index 28ff83e36d..4febc79058 100644 --- a/data/2026/CVE-2026-19414.json +++ b/data/2026/CVE-2026-19414.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files."}],"id":"CVE-2026-19414","lastModified":"2026-11-12T04:17:19.523","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.523","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files."}],"id":"CVE-2026-19414","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.523","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-19421.json b/data/2026/CVE-2026-19421.json index 4dec055f4c..77bb55837b 100644 --- a/data/2026/CVE-2026-19421.json +++ b/data/2026/CVE-2026-19421.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations."}],"id":"CVE-2026-19421","lastModified":"2026-11-12T12:18:24.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T12:18:24.260","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19421.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations."}],"id":"CVE-2026-19421","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T12:18:24.260","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19421.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-19422.json b/data/2026/CVE-2026-19422.json index 19a0b1690d..c855139a1f 100644 --- a/data/2026/CVE-2026-19422.json +++ b/data/2026/CVE-2026-19422.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications."}],"id":"CVE-2026-19422","lastModified":"2026-11-12T13:17:16.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T13:17:16.347","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications."}],"id":"CVE-2026-19422","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T13:17:16.347","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-19552.json b/data/2026/CVE-2026-19552.json index ad49b06f5b..2b6e9cdf1e 100644 --- a/data/2026/CVE-2026-19552.json +++ b/data/2026/CVE-2026-19552.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["ssl"],"product":"CPython","repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","versions":[{"lessThan":"3.16.0a2","status":"affected","version":"0","versionType":"python"}]}],"source":"cna@python.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked."}],"id":"CVE-2026-19552","lastModified":"2026-11-11T01:17:16.593","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":0.0,"baseSeverity":"NONE","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@python.org","type":"Secondary"}]},"published":"2026-11-09T15:17:21.017","references":[{"source":"cna@python.org","url":"https://github.com/python/cpython/commit/8dde46eaa6baf5f027a7234845b20d50b509624e"},{"source":"cna@python.org","url":"https://github.com/python/cpython/issues/161503"},{"source":"cna@python.org","url":"https://github.com/python/cpython/pull/161507"},{"source":"cna@python.org","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/25"}],"sourceIdentifier":"cna@python.org","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["ssl"],"product":"CPython","repo":"https://github.com/python/cpython","vendor":"Python Software Foundation","versions":[{"lessThan":"3.16.0a2","status":"affected","version":"0","versionType":"python"}]}],"source":"cna@python.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked."}],"id":"CVE-2026-19552","lastModified":"2026-11-12T17:17:45.580","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":0.0,"baseSeverity":"NONE","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@python.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-19552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:29:34.238521Z","version":"2.0.3"}}]},"published":"2026-11-09T15:17:21.017","references":[{"source":"cna@python.org","url":"https://github.com/python/cpython/commit/8dde46eaa6baf5f027a7234845b20d50b509624e"},{"source":"cna@python.org","url":"https://github.com/python/cpython/issues/161503"},{"source":"cna@python.org","url":"https://github.com/python/cpython/pull/161507"},{"source":"cna@python.org","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/25"}],"sourceIdentifier":"cna@python.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-19706.json b/data/2026/CVE-2026-19706.json index 8335cbb203..03e303d8fa 100644 --- a/data/2026/CVE-2026-19706.json +++ b/data/2026/CVE-2026-19706.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:assisted_installer:2"],"defaultStatus":"unaffected","packageName":"assisted/agent-preinstall-image-builder-rhel9","product":"Assisted Installer for Red Hat OpenShift Container Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:assisted_installer:2"],"defaultStatus":"affected","packageName":"rhai/assisted-installer-agent-rhel9","product":"Assisted Installer for Red Hat OpenShift Container Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:assisted_installer:2"],"defaultStatus":"affected","packageName":"rhai/assisted-installer-controller-rhel9","product":"Assisted Installer for Red Hat OpenShift Container Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"],"defaultStatus":"affected","packageName":"multicluster-engine/assisted-installer-agent-rhel8","product":"Multicluster Engine for Kubernetes","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"],"defaultStatus":"affected","packageName":"multicluster-engine/assisted-installer-agent-rhel9","product":"Multicluster Engine for Kubernetes","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"],"defaultStatus":"affected","packageName":"multicluster-engine/assisted-installer-controller-rhel8","product":"Multicluster Engine for Kubernetes","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"],"defaultStatus":"affected","packageName":"multicluster-engine/assisted-installer-controller-rhel9","product":"Multicluster Engine for Kubernetes","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-agent-installer-csr-approver-rhel8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-agent-installer-csr-approver-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift4/ose-agent-installer-orchestrator-rhel8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift4/ose-agent-installer-orchestrator-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift5/ose-agent-installer-csr-approver-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift5/ose-agent-installer-orchestrator-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.\n\nAn attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.\n\nExploitable only during the narrow bootstrap window."}],"id":"CVE-2026-19706","lastModified":"2026-11-09T23:17:22.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":6.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-19706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:44:42.460170Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:27.583","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-19706"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515215"},{"source":"secalert@redhat.com","url":"https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/installing_an_on-premise_cluster_with_the_agent-based_installer/index"},{"source":"secalert@redhat.com","url":"https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:assisted_installer:2"],"defaultStatus":"unaffected","packageName":"assisted/agent-preinstall-image-builder-rhel9","product":"Assisted Installer for Red Hat OpenShift Container Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:assisted_installer:2"],"defaultStatus":"affected","packageName":"rhai/assisted-installer-agent-rhel9","product":"Assisted Installer for Red Hat OpenShift Container Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:assisted_installer:2"],"defaultStatus":"affected","packageName":"rhai/assisted-installer-controller-rhel9","product":"Assisted Installer for Red Hat OpenShift Container Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"],"defaultStatus":"affected","packageName":"multicluster-engine/assisted-installer-agent-rhel8","product":"Multicluster Engine for Kubernetes","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"],"defaultStatus":"affected","packageName":"multicluster-engine/assisted-installer-agent-rhel9","product":"Multicluster Engine for Kubernetes","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"],"defaultStatus":"affected","packageName":"multicluster-engine/assisted-installer-controller-rhel8","product":"Multicluster Engine for Kubernetes","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_engine"],"defaultStatus":"affected","packageName":"multicluster-engine/assisted-installer-controller-rhel9","product":"Multicluster Engine for Kubernetes","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-agent-installer-csr-approver-rhel8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-agent-installer-csr-approver-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift4/ose-agent-installer-orchestrator-rhel8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift4/ose-agent-installer-orchestrator-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unknown","packageName":"openshift4/ose-baremetal-installer-rhel8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unknown","packageName":"openshift4/ose-baremetal-installer-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unknown","packageName":"openshift4/ose-installer","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unknown","packageName":"openshift4/ose-installer-altinfra-rhel8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unknown","packageName":"openshift4/ose-installer-altinfra-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unknown","packageName":"openshift4/ose-installer-artifacts","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unknown","packageName":"openshift4/ose-installer-artifacts-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unknown","packageName":"openshift4/ose-installer-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift5/ose-agent-installer-csr-approver-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift5/ose-agent-installer-orchestrator-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unknown","packageName":"openshift5/ose-baremetal-installer-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unknown","packageName":"openshift5/ose-installer-artifacts-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unknown","packageName":"openshift5/ose-installer-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation.\n\nAn attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access.\n\nExploitable only during the narrow bootstrap window."}],"id":"CVE-2026-19706","lastModified":"2026-11-12T18:17:46.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":6.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-19706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:44:42.460170Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:27.583","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-19706"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515215"},{"source":"secalert@redhat.com","url":"https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/installing_an_on-premise_cluster_with_the_agent-based_installer/index"},{"source":"secalert@redhat.com","url":"https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-19833.json b/data/2026/CVE-2026-19833.json index 1d62a9244c..145d77e85d 100644 --- a/data/2026/CVE-2026-19833.json +++ b/data/2026/CVE-2026-19833.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in the ACL API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files."}],"id":"CVE-2026-19833","lastModified":"2026-11-12T04:17:19.727","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.727","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in the ACL API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files."}],"id":"CVE-2026-19833","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.727","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-20183.json b/data/2026/CVE-2026-20183.json index d608a0c72e..be537a38aa 100644 --- a/data/2026/CVE-2026-20183.json +++ b/data/2026/CVE-2026-20183.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Cisco Identity Services Engine Software","vendor":"Cisco","versions":[{"status":"affected","version":"3.1.0"},{"status":"affected","version":"3.1.0 p1"},{"status":"affected","version":"3.1.0 p3"},{"status":"affected","version":"3.1.0 p2"},{"status":"affected","version":"3.2.0"},{"status":"affected","version":"3.1.0 p4"},{"status":"affected","version":"3.1.0 p5"},{"status":"affected","version":"3.2.0 p1"},{"status":"affected","version":"3.1.0 p6"},{"status":"affected","version":"3.2.0 p2"},{"status":"affected","version":"3.1.0 p7"},{"status":"affected","version":"3.3.0"},{"status":"affected","version":"3.2.0 p3"},{"status":"affected","version":"3.2.0 p4"},{"status":"affected","version":"3.1.0 p8"},{"status":"affected","version":"3.2.0 p5"},{"status":"affected","version":"3.2.0 p6"},{"status":"affected","version":"3.1.0 p9"},{"status":"affected","version":"3.3 Patch 2"},{"status":"affected","version":"3.3 Patch 1"},{"status":"affected","version":"3.3 Patch 3"},{"status":"affected","version":"3.4.0"},{"status":"affected","version":"3.2.0 p7"},{"status":"affected","version":"3.3 Patch 4"},{"status":"affected","version":"3.4 Patch 1"},{"status":"affected","version":"3.1.0 p10"},{"status":"affected","version":"3.3 Patch 5"},{"status":"affected","version":"3.3 Patch 6"},{"status":"affected","version":"3.4 Patch 2"},{"status":"affected","version":"3.3 Patch 7"},{"status":"affected","version":"3.4 Patch 3"},{"status":"affected","version":"3.5.0"},{"status":"affected","version":"3.4 Patch 4"},{"status":"affected","version":"3.3 Patch 8"},{"status":"affected","version":"3.2 Patch 8"},{"status":"affected","version":"3.5 Patch 1"},{"status":"affected","version":"3.3 Patch 9"},{"status":"affected","version":"3.2 Patch 9"},{"status":"affected","version":"3.4 Patch 5"},{"status":"affected","version":"3.5 Patch 3"},{"status":"affected","version":"3.5 Patch 2"},{"status":"affected","version":"3.3 Patch 10"},{"status":"affected","version":"3.3 Patch 11"},{"status":"affected","version":"3.4 Patch 6"},{"status":"affected","version":"3.2 Patch 10"},{"status":"affected","version":"3.1.0 p11"},{"status":"affected","version":"3.1.0 p12"},{"status":"affected","version":"3.2 Patch 11"}]}],"source":"psirt@cisco.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device.\r\n\r\nThis vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on a specific page. To exploit this vulnerability, an attacker would need valid Administrator credentials."}],"id":"CVE-2026-20183","lastModified":"2026-11-10T23:17:21.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@cisco.com","type":"Primary"}]},"published":"2026-11-10T23:17:21.023","references":[{"source":"psirt@cisco.com","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-1-MxcTNgwx"}],"sourceIdentifier":"psirt@cisco.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"psirt@cisco.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Cisco Identity Services Engine Software","vendor":"Cisco","versions":[{"status":"affected","version":"3.1.0"},{"status":"affected","version":"3.1.0 p1"},{"status":"affected","version":"3.1.0 p3"},{"status":"affected","version":"3.1.0 p2"},{"status":"affected","version":"3.2.0"},{"status":"affected","version":"3.1.0 p4"},{"status":"affected","version":"3.1.0 p5"},{"status":"affected","version":"3.2.0 p1"},{"status":"affected","version":"3.1.0 p6"},{"status":"affected","version":"3.2.0 p2"},{"status":"affected","version":"3.1.0 p7"},{"status":"affected","version":"3.3.0"},{"status":"affected","version":"3.2.0 p3"},{"status":"affected","version":"3.2.0 p4"},{"status":"affected","version":"3.1.0 p8"},{"status":"affected","version":"3.2.0 p5"},{"status":"affected","version":"3.2.0 p6"},{"status":"affected","version":"3.1.0 p9"},{"status":"affected","version":"3.3 Patch 2"},{"status":"affected","version":"3.3 Patch 1"},{"status":"affected","version":"3.3 Patch 3"},{"status":"affected","version":"3.4.0"},{"status":"affected","version":"3.2.0 p7"},{"status":"affected","version":"3.3 Patch 4"},{"status":"affected","version":"3.4 Patch 1"},{"status":"affected","version":"3.1.0 p10"},{"status":"affected","version":"3.3 Patch 5"},{"status":"affected","version":"3.3 Patch 6"},{"status":"affected","version":"3.4 Patch 2"},{"status":"affected","version":"3.3 Patch 7"},{"status":"affected","version":"3.4 Patch 3"},{"status":"affected","version":"3.5.0"},{"status":"affected","version":"3.4 Patch 4"},{"status":"affected","version":"3.3 Patch 8"},{"status":"affected","version":"3.2 Patch 8"},{"status":"affected","version":"3.5 Patch 1"},{"status":"affected","version":"3.3 Patch 9"},{"status":"affected","version":"3.2 Patch 9"},{"status":"affected","version":"3.4 Patch 5"},{"status":"affected","version":"3.5 Patch 3"},{"status":"affected","version":"3.5 Patch 2"},{"status":"affected","version":"3.3 Patch 10"},{"status":"affected","version":"3.3 Patch 11"},{"status":"affected","version":"3.4 Patch 6"},{"status":"affected","version":"3.2 Patch 10"},{"status":"affected","version":"3.1.0 p11"},{"status":"affected","version":"3.1.0 p12"},{"status":"affected","version":"3.2 Patch 11"}]}],"source":"psirt@cisco.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device.\r\n\r\nThis vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on a specific page. To exploit this vulnerability, an attacker would need valid Administrator credentials."}],"id":"CVE-2026-20183","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@cisco.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:26:53.566059Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:21.023","references":[{"source":"psirt@cisco.com","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-1-MxcTNgwx"}],"sourceIdentifier":"psirt@cisco.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"psirt@cisco.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20573.json b/data/2026/CVE-2026-20573.json index c54b4d9c0f..6bef36f023 100644 --- a/data/2026/CVE-2026-20573.json +++ b/data/2026/CVE-2026-20573.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980D"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8168"},{"status":"affected","version":"MT8186"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8195"},{"status":"affected","version":"MT8196"},{"status":"affected","version":"MT8365"},{"status":"affected","version":"MT8367"},{"status":"affected","version":"MT8390"},{"status":"affected","version":"MT8391"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8793"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923."}],"id":"CVE-2026-20573","lastModified":"2026-11-03T05:18:39.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:34.893","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980D"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8168"},{"status":"affected","version":"MT8186"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8195"},{"status":"affected","version":"MT8196"},{"status":"affected","version":"MT8365"},{"status":"affected","version":"MT8367"},{"status":"affected","version":"MT8390"},{"status":"affected","version":"MT8391"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8793"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980d_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63E39158-4501-494C-B989-4572AB72E970","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980d:-:*:*:*:*:*:*:*","matchCriteriaId":"2758122C-4D11-4D34-9B72-3905F3A28448","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8168_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0FEAF334-350A-49B3-9AF1-B2F1A081823C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8168:-:*:*:*:*:*:*:*","matchCriteriaId":"3CE2FC35-716A-4706-97BA-5DB165041580","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3CEE2EEE-3512-429F-9DAD-E17D64CE447D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*","matchCriteriaId":"E4932D34-06F4-49D7-81FB-772A82E8A5B5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4E513B6-2909-4CA3-AF80-F1AE88BE4F18","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*","matchCriteriaId":"ED210E64-6CE7-42B1-849E-68C0E22521F6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8365_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"76A9E1A0-FDEB-4FA5-BEF8-FAB8BF72E7A3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8365:-:*:*:*:*:*:*:*","matchCriteriaId":"97C76F98-5D8D-4E52-ABAF-CD27C1205B0E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32C24935-B6E6-4923-B81C-D29BBEED2B3C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:*","matchCriteriaId":"A28FA947-314F-465B-8ADD-F7973F02D82A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9627AD8C-49C7-43C4-850E-6BC37FA2F619","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*","matchCriteriaId":"B774B7D7-B7DD-43A0-833F-7E39DF82CA60","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923."}],"id":"CVE-2026-20573","lastModified":"2026-11-12T16:49:33.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:34.893","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20574.json b/data/2026/CVE-2026-20574.json index 64c5c39732..f708e110dc 100644 --- a/data/2026/CVE-2026-20574.json +++ b/data/2026/CVE-2026-20574.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980D"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8168"},{"status":"affected","version":"MT8186"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8195"},{"status":"affected","version":"MT8196"},{"status":"affected","version":"MT8365"},{"status":"affected","version":"MT8367"},{"status":"affected","version":"MT8390"},{"status":"affected","version":"MT8391"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8793"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431400; Issue ID: MSV-9922."}],"id":"CVE-2026-20574","lastModified":"2026-11-03T05:18:39.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.027","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980D"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8168"},{"status":"affected","version":"MT8186"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8195"},{"status":"affected","version":"MT8196"},{"status":"affected","version":"MT8365"},{"status":"affected","version":"MT8367"},{"status":"affected","version":"MT8390"},{"status":"affected","version":"MT8391"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8793"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980d_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63E39158-4501-494C-B989-4572AB72E970","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980d:-:*:*:*:*:*:*:*","matchCriteriaId":"2758122C-4D11-4D34-9B72-3905F3A28448","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8168_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0FEAF334-350A-49B3-9AF1-B2F1A081823C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8168:-:*:*:*:*:*:*:*","matchCriteriaId":"3CE2FC35-716A-4706-97BA-5DB165041580","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3CEE2EEE-3512-429F-9DAD-E17D64CE447D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*","matchCriteriaId":"E4932D34-06F4-49D7-81FB-772A82E8A5B5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4E513B6-2909-4CA3-AF80-F1AE88BE4F18","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*","matchCriteriaId":"ED210E64-6CE7-42B1-849E-68C0E22521F6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8365_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"76A9E1A0-FDEB-4FA5-BEF8-FAB8BF72E7A3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8365:-:*:*:*:*:*:*:*","matchCriteriaId":"97C76F98-5D8D-4E52-ABAF-CD27C1205B0E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32C24935-B6E6-4923-B81C-D29BBEED2B3C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:*","matchCriteriaId":"A28FA947-314F-465B-8ADD-F7973F02D82A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9627AD8C-49C7-43C4-850E-6BC37FA2F619","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*","matchCriteriaId":"B774B7D7-B7DD-43A0-833F-7E39DF82CA60","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431400; Issue ID: MSV-9922."}],"id":"CVE-2026-20574","lastModified":"2026-11-12T16:48:42.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.027","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20575.json b/data/2026/CVE-2026-20575.json index 3a8304648a..6af9510c15 100644 --- a/data/2026/CVE-2026-20575.json +++ b/data/2026/CVE-2026-20575.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-9921."}],"id":"CVE-2026-20575","lastModified":"2026-11-03T05:18:40.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.150","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-9921."}],"id":"CVE-2026-20575","lastModified":"2026-11-12T16:48:08.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.150","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20576.json b/data/2026/CVE-2026-20576.json index 624085357a..d739750593 100644 --- a/data/2026/CVE-2026-20576.json +++ b/data/2026/CVE-2026-20576.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431385; Issue ID: MSV-9920."}],"id":"CVE-2026-20576","lastModified":"2026-11-03T05:18:40.383","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20576","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.270","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431385; Issue ID: MSV-9920."}],"id":"CVE-2026-20576","lastModified":"2026-11-12T16:48:00.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20576","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.270","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20577.json b/data/2026/CVE-2026-20577.json index f59b7469ac..00507d3c9d 100644 --- a/data/2026/CVE-2026-20577.json +++ b/data/2026/CVE-2026-20577.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01880753; Issue ID: MSV-9866."}],"id":"CVE-2026-20577","lastModified":"2026-11-02T17:17:42.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T16:45:33.861461Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.397","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01880753; Issue ID: MSV-9866."}],"id":"CVE-2026-20577","lastModified":"2026-11-12T16:47:54.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T16:45:33.861461Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.397","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20578.json b/data/2026/CVE-2026-20578.json index f3091b4875..b529e03421 100644 --- a/data/2026/CVE-2026-20578.json +++ b/data/2026/CVE-2026-20578.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879164; Issue ID: MSV-9846."}],"id":"CVE-2026-20578","lastModified":"2026-11-02T16:18:52.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20578","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:30.443862Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.527","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-757"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879164; Issue ID: MSV-9846."}],"id":"CVE-2026-20578","lastModified":"2026-11-12T16:47:47.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20578","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:30.443862Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.527","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-757"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20580.json b/data/2026/CVE-2026-20580.json index b62f2abd5b..c00311aedf 100644 --- a/data/2026/CVE-2026-20580.json +++ b/data/2026/CVE-2026-20580.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8196"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8786"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11412004; Issue ID: MSV-9752."}],"id":"CVE-2026-20580","lastModified":"2026-11-02T17:17:43.160","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T16:46:03.578418Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.660","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8196"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8786"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11412004; Issue ID: MSV-9752."}],"id":"CVE-2026-20580","lastModified":"2026-11-12T16:47:40.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T16:46:03.578418Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.660","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20581.json b/data/2026/CVE-2026-20581.json index e86859a58d..25dab25781 100644 --- a/data/2026/CVE-2026-20581.json +++ b/data/2026/CVE-2026-20581.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8518S"},{"status":"affected","version":"MT8532"},{"status":"affected","version":"MT8668"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411985; Issue ID: MSV-9750."}],"id":"CVE-2026-20581","lastModified":"2026-11-03T05:18:40.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.787","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8518S"},{"status":"affected","version":"MT8532"},{"status":"affected","version":"MT8668"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8518s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"773DA646-5B06-47AF-9272-856DFB6C6DFE","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8518s:-:*:*:*:*:*:*:*","matchCriteriaId":"6069CD03-6AB1-4A06-88CF-EFBDEA84CDE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8532_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB5568FB-4D73-40F2-92E7-6E22780BF0F2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8532:-:*:*:*:*:*:*:*","matchCriteriaId":"EE18D5C2-0423-4CE5-86E7-69E7BB131BBF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411985; Issue ID: MSV-9750."}],"id":"CVE-2026-20581","lastModified":"2026-11-12T16:47:33.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.787","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20582.json b/data/2026/CVE-2026-20582.json index d410307136..e91e30ffe2 100644 --- a/data/2026/CVE-2026-20582.json +++ b/data/2026/CVE-2026-20582.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8518S"},{"status":"affected","version":"MT8532"},{"status":"affected","version":"MT8668"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748."}],"id":"CVE-2026-20582","lastModified":"2026-11-03T05:18:40.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.913","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8518S"},{"status":"affected","version":"MT8532"},{"status":"affected","version":"MT8668"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8518s_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"773DA646-5B06-47AF-9272-856DFB6C6DFE","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8518s:-:*:*:*:*:*:*:*","matchCriteriaId":"6069CD03-6AB1-4A06-88CF-EFBDEA84CDE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8532_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB5568FB-4D73-40F2-92E7-6E22780BF0F2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8532:-:*:*:*:*:*:*:*","matchCriteriaId":"EE18D5C2-0423-4CE5-86E7-69E7BB131BBF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748."}],"id":"CVE-2026-20582","lastModified":"2026-11-12T16:47:27.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:35.913","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20583.json b/data/2026/CVE-2026-20583.json index 1825644ce8..2cb16574c3 100644 --- a/data/2026/CVE-2026-20583.json +++ b/data/2026/CVE-2026-20583.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8196"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8786"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9747."}],"id":"CVE-2026-20583","lastModified":"2026-11-02T17:17:43.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20583","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T16:44:57.806265Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.037","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8196"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8786"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9747."}],"id":"CVE-2026-20583","lastModified":"2026-11-12T16:47:22.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20583","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T16:44:57.806265Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.037","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20584.json b/data/2026/CVE-2026-20584.json index d05da6171f..b2d2617d6f 100644 --- a/data/2026/CVE-2026-20584.json +++ b/data/2026/CVE-2026-20584.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9746."}],"id":"CVE-2026-20584","lastModified":"2026-11-03T05:18:41.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20584","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.163","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9746."}],"id":"CVE-2026-20584","lastModified":"2026-11-12T16:47:16.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20584","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.163","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20585.json b/data/2026/CVE-2026-20585.json index a1c0004661..80331bd03c 100644 --- a/data/2026/CVE-2026-20585.json +++ b/data/2026/CVE-2026-20585.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2718"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8186"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8195"},{"status":"affected","version":"MT8196"},{"status":"affected","version":"MT8367"},{"status":"affected","version":"MT8391"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01338165; Issue ID: MSV-9660."}],"id":"CVE-2026-20585","lastModified":"2026-11-03T05:18:41.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.283","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2718"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8186"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8195"},{"status":"affected","version":"MT8196"},{"status":"affected","version":"MT8367"},{"status":"affected","version":"MT8391"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DDCA451B-219B-4490-98F3-60A569B5C513","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*","matchCriteriaId":"F5506327-7DDF-4E88-9EA8-10B8E32F848B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3CEE2EEE-3512-429F-9DAD-E17D64CE447D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*","matchCriteriaId":"E4932D34-06F4-49D7-81FB-772A82E8A5B5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4E513B6-2909-4CA3-AF80-F1AE88BE4F18","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*","matchCriteriaId":"ED210E64-6CE7-42B1-849E-68C0E22521F6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32C24935-B6E6-4923-B81C-D29BBEED2B3C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:*","matchCriteriaId":"A28FA947-314F-465B-8ADD-F7973F02D82A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01338165; Issue ID: MSV-9660."}],"id":"CVE-2026-20585","lastModified":"2026-11-12T16:47:05.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.283","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20590.json b/data/2026/CVE-2026-20590.json index e550ff2a05..4b9eb4dbe2 100644 --- a/data/2026/CVE-2026-20590.json +++ b/data/2026/CVE-2026-20590.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8793"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In display, there is a possible system crash due to a logic error. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11410704; Issue ID: MSV-9574."}],"id":"CVE-2026-20590","lastModified":"2026-11-02T17:17:43.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T16:44:28.985887Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.410","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8793"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In display, there is a possible system crash due to a logic error. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11410704; Issue ID: MSV-9574."}],"id":"CVE-2026-20590","lastModified":"2026-11-12T16:46:37.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T16:44:28.985887Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.410","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20591.json b/data/2026/CVE-2026-20591.json index 4434d0fa93..beb1921a32 100644 --- a/data/2026/CVE-2026-20591.json +++ b/data/2026/CVE-2026-20591.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8910"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365075; Issue ID: MSV-9546."}],"id":"CVE-2026-20591","lastModified":"2026-11-03T05:18:41.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.537","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8910"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365075; Issue ID: MSV-9546."}],"id":"CVE-2026-20591","lastModified":"2026-11-12T16:46:31.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.537","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20592.json b/data/2026/CVE-2026-20592.json index aee2462c7a..d767519f14 100644 --- a/data/2026/CVE-2026-20592.json +++ b/data/2026/CVE-2026-20592.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01744265; Issue ID: MSV-9505."}],"id":"CVE-2026-20592","lastModified":"2026-11-02T16:18:52.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.5,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20592","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:09:35.381389Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.657","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01744265; Issue ID: MSV-9505."}],"id":"CVE-2026-20592","lastModified":"2026-11-12T16:45:59.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.5,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20592","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:09:35.381389Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.657","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20593.json b/data/2026/CVE-2026-20593.json index 22ebb0cade..fa254d758c 100644 --- a/data/2026/CVE-2026-20593.json +++ b/data/2026/CVE-2026-20593.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6762"},{"status":"affected","version":"MT6763"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6767"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6771"},{"status":"affected","version":"MT6779"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6783"},{"status":"affected","version":"MT6785"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8765"},{"status":"affected","version":"MT8766"},{"status":"affected","version":"MT8766R"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8781"},{"status":"affected","version":"MT8786"},{"status":"affected","version":"MT8788E"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01707455; Issue ID: MSV-9503."}],"id":"CVE-2026-20593","lastModified":"2026-11-02T16:18:52.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20593","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:28.204754Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.790","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6762"},{"status":"affected","version":"MT6763"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6767"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6771"},{"status":"affected","version":"MT6779"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6783"},{"status":"affected","version":"MT6785"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8765"},{"status":"affected","version":"MT8766"},{"status":"affected","version":"MT8766R"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8781"},{"status":"affected","version":"MT8786"},{"status":"affected","version":"MT8788E"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6762_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"712798EA-AE09-4053-9124-E16E1FB309F1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*","matchCriteriaId":"C445EB80-6021-4E26-B74E-1B4B6910CE48","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6763_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7545A96-E05D-4A48-818C-5F172C594F54","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*","matchCriteriaId":"2F19C76A-50DF-4ACA-BACA-07157B4D838B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6767_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0ED6AF6-9F84-47AB-8D9D-F5BBFD851093","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*","matchCriteriaId":"3367BA13-9C4D-4CCF-8E71-397F33CFF773","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C98C5B2-1B08-4E46-A845-3B19EE801A9E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*","matchCriteriaId":"BE4D2AED-C713-407F-A34A-52C3D8F65835","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2C031857-65FD-4644-AF44-F9D09303472D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*","matchCriteriaId":"EBA369B8-8E23-492B-82CC-23114E6A5D1C","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21ABBF98-6C62-4C4E-AF1E-4EB94D20544C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*","matchCriteriaId":"F2C8F9C2-6471-4498-B089-2F40D2483487","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2569740E-FAF9-4324-9399-F6C0A03D4C25","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*","matchCriteriaId":"A82E0A4F-072F-474C-B94C-8114ABE05639","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8766r_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"934CDBC2-33EC-4C78-8C82-711869C9CED5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*","matchCriteriaId":"738475DC-9FA8-4034-AB1F-F89C77CE7B41","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01707455; Issue ID: MSV-9503."}],"id":"CVE-2026-20593","lastModified":"2026-11-12T16:45:46.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20593","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:28.204754Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.790","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20594.json b/data/2026/CVE-2026-20594.json index 8bc65359e8..e6480b7725 100644 --- a/data/2026/CVE-2026-20594.json +++ b/data/2026/CVE-2026-20594.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01349680 / MOLY01369097; Issue ID: MSV-9364."}],"id":"CVE-2026-20594","lastModified":"2026-11-02T16:18:52.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:25.360887Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.930","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01349680 / MOLY01369097; Issue ID: MSV-9364."}],"id":"CVE-2026-20594","lastModified":"2026-11-12T16:45:41.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:25.360887Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:36.930","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20595.json b/data/2026/CVE-2026-20595.json index 84518a6fc9..06cf3e3aef 100644 --- a/data/2026/CVE-2026-20595.json +++ b/data/2026/CVE-2026-20595.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8168"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8321"},{"status":"affected","version":"MT8385"},{"status":"affected","version":"MT8696"},{"status":"affected","version":"MT8765"},{"status":"affected","version":"MT8766"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8781"},{"status":"affected","version":"MT8786"},{"status":"affected","version":"MT8788"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8910"},{"status":"affected","version":"MT8911"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001."}],"id":"CVE-2026-20595","lastModified":"2026-11-03T05:18:41.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20595","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.053","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1286"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8168"},{"status":"affected","version":"MT8188"},{"status":"affected","version":"MT8189"},{"status":"affected","version":"MT8321"},{"status":"affected","version":"MT8385"},{"status":"affected","version":"MT8696"},{"status":"affected","version":"MT8765"},{"status":"affected","version":"MT8766"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8781"},{"status":"affected","version":"MT8786"},{"status":"affected","version":"MT8788"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8910"},{"status":"affected","version":"MT8911"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8168_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0FEAF334-350A-49B3-9AF1-B2F1A081823C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8168:-:*:*:*:*:*:*:*","matchCriteriaId":"3CE2FC35-716A-4706-97BA-5DB165041580","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8321_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4E84B9DB-6BF4-4B26-9E1F-FBA420C00098","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8321:-:*:*:*:*:*:*:*","matchCriteriaId":"793B7F88-79E7-4031-8AD0-35C9BFD073C4","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8385_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"71099061-5361-40F3-A980-24CA6C819913","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8385:-:*:*:*:*:*:*:*","matchCriteriaId":"299378ED-41CE-4966-99B1-65D2BA1215EF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0E6EB8-31E4-4702-891A-9B34C0535BD6","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*","matchCriteriaId":"26573298-76BC-49FE-8D99-CF03ED01B185","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8788_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD62F681-A2D1-4A8B-B087-7835ED500D69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*","matchCriteriaId":"FE10C121-F2AD-43D2-8FF9-A6C197858220","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8911_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AB5A7C39-1B86-4680-8F6F-000703DBE8E6","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8911:-:*:*:*:*:*:*:*","matchCriteriaId":"7FBC4D08-6A99-4FD4-8316-7680D6D1CE23","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001."}],"id":"CVE-2026-20595","lastModified":"2026-11-12T16:45:33.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20595","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.053","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1286"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20596.json b/data/2026/CVE-2026-20596.json index 8e48ed0caa..0d8884cfe7 100644 --- a/data/2026/CVE-2026-20596.json +++ b/data/2026/CVE-2026-20596.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6762"},{"status":"affected","version":"MT6763"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6767"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6771"},{"status":"affected","version":"MT6779"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6783"},{"status":"affected","version":"MT6785"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8765"},{"status":"affected","version":"MT8766"},{"status":"affected","version":"MT8766R"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8781"},{"status":"affected","version":"MT8786"},{"status":"affected","version":"MT8788E"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758225; Issue ID: MSV-8910."}],"id":"CVE-2026-20596","lastModified":"2026-11-02T16:18:52.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20596","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:22.701247Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.187","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6762"},{"status":"affected","version":"MT6763"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6767"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6771"},{"status":"affected","version":"MT6779"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6783"},{"status":"affected","version":"MT6785"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8765"},{"status":"affected","version":"MT8766"},{"status":"affected","version":"MT8766R"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8781"},{"status":"affected","version":"MT8786"},{"status":"affected","version":"MT8788E"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8766r_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"934CDBC2-33EC-4C78-8C82-711869C9CED5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*","matchCriteriaId":"738475DC-9FA8-4034-AB1F-F89C77CE7B41","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6762_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"712798EA-AE09-4053-9124-E16E1FB309F1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*","matchCriteriaId":"C445EB80-6021-4E26-B74E-1B4B6910CE48","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6763_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7545A96-E05D-4A48-818C-5F172C594F54","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*","matchCriteriaId":"2F19C76A-50DF-4ACA-BACA-07157B4D838B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6767_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0ED6AF6-9F84-47AB-8D9D-F5BBFD851093","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*","matchCriteriaId":"3367BA13-9C4D-4CCF-8E71-397F33CFF773","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C98C5B2-1B08-4E46-A845-3B19EE801A9E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*","matchCriteriaId":"BE4D2AED-C713-407F-A34A-52C3D8F65835","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2C031857-65FD-4644-AF44-F9D09303472D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*","matchCriteriaId":"EBA369B8-8E23-492B-82CC-23114E6A5D1C","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21ABBF98-6C62-4C4E-AF1E-4EB94D20544C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*","matchCriteriaId":"F2C8F9C2-6471-4498-B089-2F40D2483487","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2569740E-FAF9-4324-9399-F6C0A03D4C25","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*","matchCriteriaId":"A82E0A4F-072F-474C-B94C-8114ABE05639","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758225; Issue ID: MSV-8910."}],"id":"CVE-2026-20596","lastModified":"2026-11-12T16:45:28.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20596","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:22.701247Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.187","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20597.json b/data/2026/CVE-2026-20597.json index bfca98f7bc..a21d85d7b3 100644 --- a/data/2026/CVE-2026-20597.json +++ b/data/2026/CVE-2026-20597.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6762"},{"status":"affected","version":"MT6763"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6767"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6771"},{"status":"affected","version":"MT6779"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6783"},{"status":"affected","version":"MT6785"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8765"},{"status":"affected","version":"MT8766"},{"status":"affected","version":"MT8766R"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8781"},{"status":"affected","version":"MT8786"},{"status":"affected","version":"MT8788E"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758223; Issue ID: MSV-8909."}],"id":"CVE-2026-20597","lastModified":"2026-11-02T16:18:52.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20597","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:20.618099Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.323","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6762"},{"status":"affected","version":"MT6763"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6767"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6771"},{"status":"affected","version":"MT6779"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6783"},{"status":"affected","version":"MT6785"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8765"},{"status":"affected","version":"MT8766"},{"status":"affected","version":"MT8766R"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8781"},{"status":"affected","version":"MT8786"},{"status":"affected","version":"MT8788E"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6762_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"712798EA-AE09-4053-9124-E16E1FB309F1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*","matchCriteriaId":"C445EB80-6021-4E26-B74E-1B4B6910CE48","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6763_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7545A96-E05D-4A48-818C-5F172C594F54","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*","matchCriteriaId":"2F19C76A-50DF-4ACA-BACA-07157B4D838B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6767_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0ED6AF6-9F84-47AB-8D9D-F5BBFD851093","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*","matchCriteriaId":"3367BA13-9C4D-4CCF-8E71-397F33CFF773","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C98C5B2-1B08-4E46-A845-3B19EE801A9E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*","matchCriteriaId":"BE4D2AED-C713-407F-A34A-52C3D8F65835","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2C031857-65FD-4644-AF44-F9D09303472D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*","matchCriteriaId":"EBA369B8-8E23-492B-82CC-23114E6A5D1C","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21ABBF98-6C62-4C4E-AF1E-4EB94D20544C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*","matchCriteriaId":"F2C8F9C2-6471-4498-B089-2F40D2483487","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2569740E-FAF9-4324-9399-F6C0A03D4C25","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*","matchCriteriaId":"A82E0A4F-072F-474C-B94C-8114ABE05639","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8766r_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"934CDBC2-33EC-4C78-8C82-711869C9CED5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*","matchCriteriaId":"738475DC-9FA8-4034-AB1F-F89C77CE7B41","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758223; Issue ID: MSV-8909."}],"id":"CVE-2026-20597","lastModified":"2026-11-12T16:44:52.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20597","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:20.618099Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.323","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20598.json b/data/2026/CVE-2026-20598.json index abf9ecdc18..f3e58a7b9d 100644 --- a/data/2026/CVE-2026-20598.json +++ b/data/2026/CVE-2026-20598.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01755742; Issue ID: MSV-8896."}],"id":"CVE-2026-20598","lastModified":"2026-11-02T16:18:52.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20598","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:17.358951Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.500","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01755742; Issue ID: MSV-8896."}],"id":"CVE-2026-20598","lastModified":"2026-11-12T16:44:45.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20598","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T15:00:17.358951Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.500","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20599.json b/data/2026/CVE-2026-20599.json index 40a646de3e..3daa5af449 100644 --- a/data/2026/CVE-2026-20599.json +++ b/data/2026/CVE-2026-20599.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6762"},{"status":"affected","version":"MT6763"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6767"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6771"},{"status":"affected","version":"MT6779"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6783"},{"status":"affected","version":"MT6785"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8765"},{"status":"affected","version":"MT8766"},{"status":"affected","version":"MT8766R"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8781"},{"status":"affected","version":"MT8786"},{"status":"affected","version":"MT8788E"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148."}],"id":"CVE-2026-20599","lastModified":"2026-11-03T05:18:42.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.657","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6739"},{"status":"affected","version":"MT6761"},{"status":"affected","version":"MT6762"},{"status":"affected","version":"MT6763"},{"status":"affected","version":"MT6765"},{"status":"affected","version":"MT6767"},{"status":"affected","version":"MT6768"},{"status":"affected","version":"MT6769"},{"status":"affected","version":"MT6771"},{"status":"affected","version":"MT6779"},{"status":"affected","version":"MT6781"},{"status":"affected","version":"MT6783"},{"status":"affected","version":"MT6785"},{"status":"affected","version":"MT6789"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8765"},{"status":"affected","version":"MT8766"},{"status":"affected","version":"MT8766R"},{"status":"affected","version":"MT8768"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8781"},{"status":"affected","version":"MT8786"},{"status":"affected","version":"MT8788E"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6762_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"712798EA-AE09-4053-9124-E16E1FB309F1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*","matchCriteriaId":"C445EB80-6021-4E26-B74E-1B4B6910CE48","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6763_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7545A96-E05D-4A48-818C-5F172C594F54","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*","matchCriteriaId":"2F19C76A-50DF-4ACA-BACA-07157B4D838B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6767_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0ED6AF6-9F84-47AB-8D9D-F5BBFD851093","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*","matchCriteriaId":"3367BA13-9C4D-4CCF-8E71-397F33CFF773","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C98C5B2-1B08-4E46-A845-3B19EE801A9E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*","matchCriteriaId":"BE4D2AED-C713-407F-A34A-52C3D8F65835","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2C031857-65FD-4644-AF44-F9D09303472D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*","matchCriteriaId":"EBA369B8-8E23-492B-82CC-23114E6A5D1C","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21ABBF98-6C62-4C4E-AF1E-4EB94D20544C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*","matchCriteriaId":"F2C8F9C2-6471-4498-B089-2F40D2483487","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2569740E-FAF9-4324-9399-F6C0A03D4C25","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*","matchCriteriaId":"A82E0A4F-072F-474C-B94C-8114ABE05639","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8766r_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"934CDBC2-33EC-4C78-8C82-711869C9CED5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*","matchCriteriaId":"738475DC-9FA8-4034-AB1F-F89C77CE7B41","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148."}],"id":"CVE-2026-20599","lastModified":"2026-11-12T16:43:56.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.657","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20600.json b/data/2026/CVE-2026-20600.json index a89f0948bc..863b1229e9 100644 --- a/data/2026/CVE-2026-20600.json +++ b/data/2026/CVE-2026-20600.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01416152; Issue ID: MSV-7924."}],"id":"CVE-2026-20600","lastModified":"2026-11-02T16:18:52.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20600","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T14:55:14.232269Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.790","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01416152; Issue ID: MSV-7924."}],"id":"CVE-2026-20600","lastModified":"2026-11-12T16:54:03.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20600","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T14:55:14.232269Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.790","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-20703.json b/data/2026/CVE-2026-20703.json index 9742f0b0c8..cbe4b5d179 100644 --- a/data/2026/CVE-2026-20703.json +++ b/data/2026/CVE-2026-20703.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BigDL","vendor":"n/a","versions":[{"status":"affected","version":"before version 2.4.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Protection mechanism failure for some BigDL before version 2.4.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-20703","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:36.063","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01553.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BigDL","vendor":"n/a","versions":[{"status":"affected","version":"before version 2.4.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Protection mechanism failure for some BigDL before version 2.4.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-20703","lastModified":"2026-11-12T20:18:35.643","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20703","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:26:59.760170Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:36.063","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01553.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-26248.json b/data/2026/CVE-2026-26248.json index 422304fe63..e8ab7bbadd 100644 --- a/data/2026/CVE-2026-26248.json +++ b/data/2026/CVE-2026-26248.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"4.4.8","status":"affected","version":"4.4.0","versionType":"semver"},{"lessThanOrEqual":"4.2.8","status":"affected","version":"4.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.4","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox PaaS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.4","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests."}],"id":"CVE-2026-26248","lastModified":"2026-11-11T05:19:44.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-10T20:19:11.280","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-142"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"4.4.8","status":"affected","version":"4.4.0","versionType":"semver"},{"lessThanOrEqual":"4.2.8","status":"affected","version":"4.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.4","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox PaaS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.4","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests."}],"id":"CVE-2026-26248","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-10T20:19:11.280","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-142"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-28247.json b/data/2026/CVE-2026-28247.json index 545154753b..296ebf4da8 100644 --- a/data/2026/CVE-2026-28247.json +++ b/data/2026/CVE-2026-28247.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control Applied to Mirrored or Aliased Memory Regions in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to change the encryption bit for guest context pages potentially resulting in loss of integrity."}],"id":"CVE-2026-28247","lastModified":"2026-11-10T22:18:32.220","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:32.220","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1257"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control Applied to Mirrored or Aliased Memory Regions in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to change the encryption bit for guest context pages potentially resulting in loss of integrity."}],"id":"CVE-2026-28247","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:32.220","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1257"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-28248.json b/data/2026/CVE-2026-28248.json index 681a886cbc..7e1aa328a8 100644 --- a/data/2026/CVE-2026-28248.json +++ b/data/2026/CVE-2026-28248.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper enforcement of behavioral workflow in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to potentially launch a guest whose attestation report contains an ID key digest for an ID block that doesn't match the guest's measurement resulting in loss of integrity."}],"id":"CVE-2026-28248","lastModified":"2026-11-10T22:18:32.357","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:32.357","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-841"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper enforcement of behavioral workflow in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to potentially launch a guest whose attestation report contains an ID key digest for an ID block that doesn't match the guest's measurement resulting in loss of integrity."}],"id":"CVE-2026-28248","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:32.357","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-841"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-28249.json b/data/2026/CVE-2026-28249.json index f1ecfcf11c..d7b43ce63f 100644 --- a/data/2026/CVE-2026-28249.json +++ b/data/2026/CVE-2026-28249.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper preservation of consistency between independent representations of shared state in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to potentially affect cache coherency for guest context pages resulting in loss of integrity."}],"id":"CVE-2026-28249","lastModified":"2026-11-10T22:18:32.490","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:32.490","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1250"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper preservation of consistency between independent representations of shared state in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to potentially affect cache coherency for guest context pages resulting in loss of integrity."}],"id":"CVE-2026-28249","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:32.490","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1250"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-28730.json b/data/2026/CVE-2026-28730.json index 2d43922c04..94a7ac6cfe 100644 --- a/data/2026/CVE-2026-28730.json +++ b/data/2026/CVE-2026-28730.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Hyperscan","vendor":"n/a","versions":[{"status":"affected","version":"before version v5.4.2.1"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Null pointer dereference for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-28730","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:36.193","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Hyperscan","vendor":"n/a","versions":[{"status":"affected","version":"before version v5.4.2.1"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Null pointer dereference for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-28730","lastModified":"2026-11-12T20:18:35.837","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-28730","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:46.238810Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:36.193","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-28746.json b/data/2026/CVE-2026-28746.json index 97f4b1846c..dd3b88794e 100644 --- a/data/2026/CVE-2026-28746.json +++ b/data/2026/CVE-2026-28746.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Slim Bootloader","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in the AuthenticateComponent for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-28746","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:36.350","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Slim Bootloader","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in the AuthenticateComponent for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-28746","lastModified":"2026-11-12T20:18:36.040","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-28746","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:48.944721Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:36.350","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-33094.json b/data/2026/CVE-2026-33094.json index d678129328..5de418e047 100644 --- a/data/2026/CVE-2026-33094.json +++ b/data/2026/CVE-2026-33094.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Hyperscan","vendor":"n/a","versions":[{"status":"affected","version":"before version v5.4.2.1"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-33094","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:36.883","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Hyperscan","vendor":"n/a","versions":[{"status":"affected","version":"before version v5.4.2.1"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-33094","lastModified":"2026-11-12T20:18:36.240","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33094","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:51.472472Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:36.883","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-33379.json b/data/2026/CVE-2026-33379.json index 0cb3ca51c2..15e226e1a1 100644 --- a/data/2026/CVE-2026-33379.json +++ b/data/2026/CVE-2026-33379.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThan":"12.4.4","status":"affected","version":"12.4.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThan":"12.4.4","status":"affected","version":"12.4.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not."}],"id":"CVE-2026-33379","lastModified":"2026-11-10T18:17:37.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"security@grafana.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33379","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:39:05.352293Z","version":"2.0.3"}}]},"published":"2026-11-06T10:16:37.943","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-33379"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@grafana.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThan":"12.4.4","status":"affected","version":"12.4.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThan":"12.4.4","status":"affected","version":"12.4.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not."}],"id":"CVE-2026-33379","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"security@grafana.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33379","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:39:05.352293Z","version":"2.0.3"}}]},"published":"2026-11-06T10:16:37.943","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-33379"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40273.json b/data/2026/CVE-2026-40273.json index 4b2d593f9f..84a3fb8366 100644 --- a/data/2026/CVE-2026-40273.json +++ b/data/2026/CVE-2026-40273.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Software Development Platform (SDP)","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Medical","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted message which can cause an information disclosure in the QNX Neutrino kernel"}],"id":"CVE-2026-40273","lastModified":"2026-11-10T19:21:15.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T19:21:15.850","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141342"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"secure@blackberry.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Software Development Platform (SDP)","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Medical","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted message which can cause an information disclosure in the QNX Neutrino kernel"}],"id":"CVE-2026-40273","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T19:21:15.850","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141342"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"secure@blackberry.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40274.json b/data/2026/CVE-2026-40274.json index a5b10d04bd..03e5e5ce93 100644 --- a/data/2026/CVE-2026-40274.json +++ b/data/2026/CVE-2026-40274.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Software Development Platform (SDP)","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Medical","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel."}],"id":"CVE-2026-40274","lastModified":"2026-11-10T19:21:16.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T19:21:16.033","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141342"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"secure@blackberry.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Software Development Platform (SDP)","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Medical","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel."}],"id":"CVE-2026-40274","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T19:21:16.033","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141342"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"secure@blackberry.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40275.json b/data/2026/CVE-2026-40275.json index 03c61d1010..c618358e7e 100644 --- a/data/2026/CVE-2026-40275.json +++ b/data/2026/CVE-2026-40275.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Software Development Platform","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Medical","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel."}],"id":"CVE-2026-40275","lastModified":"2026-11-10T19:21:16.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T19:21:16.190","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141342"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@blackberry.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Software Development Platform","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX OS for Medical","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel."}],"id":"CVE-2026-40275","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T19:21:16.190","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141342"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@blackberry.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40426.json b/data/2026/CVE-2026-40426.json index fbfb2cbb08..f114aa80b6 100644 --- a/data/2026/CVE-2026-40426.json +++ b/data/2026/CVE-2026-40426.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) NPU Driver software","vendor":"n/a","versions":[{"status":"affected","version":"before version 1.33.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer underflow (wrap or wraparound) for the Intel(R) NPU Driver software before version 1.33.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40426","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:42.663","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01521.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) NPU Driver software","vendor":"n/a","versions":[{"status":"affected","version":"before version 1.33.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer underflow (wrap or wraparound) for the Intel(R) NPU Driver software before version 1.33.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40426","lastModified":"2026-11-12T20:18:36.413","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40426","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:19.510736Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:42.663","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01521.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40427.json b/data/2026/CVE-2026-40427.json index 0319cb4b3a..256512cd7a 100644 --- a/data/2026/CVE-2026-40427.json +++ b/data/2026/CVE-2026-40427.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) QuickAssist Technology Driver for Windows","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free for some Intel(R) QuickAssist Technology Driver for Windows within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40427","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:42.803","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01491.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) QuickAssist Technology Driver for Windows","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free for some Intel(R) QuickAssist Technology Driver for Windows within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40427","lastModified":"2026-11-12T20:18:36.650","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40427","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:21.775231Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:42.803","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01491.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40433.json b/data/2026/CVE-2026-40433.json index 26dd26ad98..5be9e2193b 100644 --- a/data/2026/CVE-2026-40433.json +++ b/data/2026/CVE-2026-40433.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) PROSet Wireless Wi-Fi Software for Windows","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow for some Intel(R) PROSet Wireless Wi-Fi Software for Windows within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-40433","lastModified":"2026-11-10T22:06:57.400","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:38.240","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) PROSet Wireless Wi-Fi Software for Windows","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow for some Intel(R) PROSet Wireless Wi-Fi Software for Windows within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-40433","lastModified":"2026-11-12T20:18:36.840","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40433","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:54.604869Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:38.240","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40626.json b/data/2026/CVE-2026-40626.json index b9c4dd771b..7d8666b856 100644 --- a/data/2026/CVE-2026-40626.json +++ b/data/2026/CVE-2026-40626.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Wireless Bluetooth(R) software for Windows","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled search path for some Intel(R) Wireless Bluetooth(R) software for Windows within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40626","lastModified":"2026-11-10T22:06:57.400","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:38.380","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Wireless Bluetooth(R) software for Windows","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled search path for some Intel(R) Wireless Bluetooth(R) software for Windows within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40626","lastModified":"2026-11-12T20:18:37.007","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:27:02.442358Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:38.380","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01530.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40668.json b/data/2026/CVE-2026-40668.json index 6eae19a857..f77e3840fe 100644 --- a/data/2026/CVE-2026-40668.json +++ b/data/2026/CVE-2026-40668.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to request attestation reports for VMPL 0."}],"id":"CVE-2026-40668","lastModified":"2026-11-10T22:18:32.777","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:32.777","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to request attestation reports for VMPL 0."}],"id":"CVE-2026-40668","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:32.777","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40669.json b/data/2026/CVE-2026-40669.json index 154048e37e..0b3879dab4 100644 --- a/data/2026/CVE-2026-40669.json +++ b/data/2026/CVE-2026-40669.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An off-by-one error in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to corrupt the Reverse Map Table (RMP) table, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2026-40669","lastModified":"2026-11-10T22:18:32.910","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:32.910","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An off-by-one error in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to corrupt the Reverse Map Table (RMP) table, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2026-40669","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:32.910","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40670.json b/data/2026/CVE-2026-40670.json index c4c2e50854..adb7db1d2e 100644 --- a/data/2026/CVE-2026-40670.json +++ b/data/2026/CVE-2026-40670.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper check for unusual or exceptional conditions in AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) could allow a privileged attacker to potentially overlap MMIO regions with DRAM regions resulting in loss of integrity."}],"id":"CVE-2026-40670","lastModified":"2026-11-10T22:18:33.047","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:33.047","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper check for unusual or exceptional conditions in AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) could allow a privileged attacker to potentially overlap MMIO regions with DRAM regions resulting in loss of integrity."}],"id":"CVE-2026-40670","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-10T22:18:33.047","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40693.json b/data/2026/CVE-2026-40693.json index 76d3bdd4f6..e44ba2c5a0 100644 --- a/data/2026/CVE-2026-40693.json +++ b/data/2026/CVE-2026-40693.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Workload Attestation software","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40693","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:42.930","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01520.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Workload Attestation software","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40693","lastModified":"2026-11-12T20:18:37.180","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40693","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:24.598780Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:42.930","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01520.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40694.json b/data/2026/CVE-2026-40694.json index d62a6488ea..55178c2670 100644 --- a/data/2026/CVE-2026-40694.json +++ b/data/2026/CVE-2026-40694.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Hyperscan","vendor":"n/a","versions":[{"status":"affected","version":"before version v5.4.2.1"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40694","lastModified":"2026-11-10T22:06:57.400","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:38.520","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Hyperscan","vendor":"n/a","versions":[{"status":"affected","version":"before version v5.4.2.1"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40694","lastModified":"2026-11-12T20:18:37.347","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40694","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:57.202135Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:38.520","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01511.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40704.json b/data/2026/CVE-2026-40704.json index d6611ec0cc..e489f9773f 100644 --- a/data/2026/CVE-2026-40704.json +++ b/data/2026/CVE-2026-40704.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version master"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Protection mechanism failure for some Intel Neural Compressor software before version master within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40704","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:43.063","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version master"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Protection mechanism failure for some Intel Neural Compressor software before version master within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40704","lastModified":"2026-11-12T20:18:37.517","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40704","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:26:57.401744Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:43.063","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40705.json b/data/2026/CVE-2026-40705.json index 6528723946..0df666a997 100644 --- a/data/2026/CVE-2026-40705.json +++ b/data/2026/CVE-2026-40705.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) NPU Drivers","vendor":"n/a","versions":[{"status":"affected","version":"before version 32.0.100.4778"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper resource locking for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40705","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:43.187","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01521.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-413"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) NPU Drivers","vendor":"n/a","versions":[{"status":"affected","version":"before version 32.0.100.4778"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper resource locking for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-40705","lastModified":"2026-11-12T20:18:37.680","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40705","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:27.258845Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:43.187","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01521.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-413"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40820.json b/data/2026/CVE-2026-40820.json index 85d3ee4f1c..9cf0490b56 100644 --- a/data/2026/CVE-2026-40820.json +++ b/data/2026/CVE-2026-40820.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"status":"affected","version":"2.20.0"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."}],"id":"CVE-2026-40820","lastModified":"2026-11-12T08:16:41.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-12T08:16:41.760","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-044/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-058/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"info@cert.vde.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"status":"affected","version":"2.20.0"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."}],"id":"CVE-2026-40820","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-12T08:16:41.760","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-044/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-058/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"info@cert.vde.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-40853.json b/data/2026/CVE-2026-40853.json index f177e55b5e..3d819adc3b 100644 --- a/data/2026/CVE-2026-40853.json +++ b/data/2026/CVE-2026-40853.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-svggen","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-svggen","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-40853","lastModified":"2026-11-11T19:17:39.703","metrics":{},"published":"2026-11-11T14:17:40.903","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/donct9w5lp5rlvl1p7m8cfx380d2wy4c"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/16"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-svggen","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-svggen","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-40853","lastModified":"2026-11-12T17:01:06.913","metrics":{},"published":"2026-11-11T14:17:40.903","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/donct9w5lp5rlvl1p7m8cfx380d2wy4c"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/16"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-42917.json b/data/2026/CVE-2026-42917.json index 92c2c9a136..18d8e5743d 100644 --- a/data/2026/CVE-2026-42917.json +++ b/data/2026/CVE-2026-42917.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version 3.8"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-42917","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:43.587","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version 3.8"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-42917","lastModified":"2026-11-12T20:18:37.853","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42917","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:29.637944Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:43.587","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-42966.json b/data/2026/CVE-2026-42966.json index 6fd1bc1eb3..549e32f172 100644 --- a/data/2026/CVE-2026-42966.json +++ b/data/2026/CVE-2026-42966.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version 3.8"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncaught exception for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-42966","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:43.730","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version 3.8"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncaught exception for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-42966","lastModified":"2026-11-12T20:18:38.037","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42966","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:33.103059Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:43.730","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-44265.json b/data/2026/CVE-2026-44265.json index a4b8b5a175..e7a887d944 100644 --- a/data/2026/CVE-2026-44265.json +++ b/data/2026/CVE-2026-44265.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"elo","vendor":"enspirit","versions":[{"status":"affected","version":"< 1.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1."}],"id":"CVE-2026-44265","lastModified":"2026-11-09T16:17:33.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.4,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-44265","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:29:48.350661Z","version":"2.0.3"}}]},"published":"2026-11-03T18:18:02.760","references":[{"source":"security-advisories@github.com","url":"https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"},{"source":"security-advisories@github.com","url":"https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93"},{"source":"security-advisories@github.com","url":"https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-89"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-749"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"elo","vendor":"enspirit","versions":[{"status":"affected","version":"< 1.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1."}],"id":"CVE-2026-44265","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.4,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-44265","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:29:48.350661Z","version":"2.0.3"}}]},"published":"2026-11-03T18:18:02.760","references":[{"source":"security-advisories@github.com","url":"https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5"},{"source":"security-advisories@github.com","url":"https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93"},{"source":"security-advisories@github.com","url":"https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-89"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-749"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-44627.json b/data/2026/CVE-2026-44627.json index ccb7c357d5..5c75f36efd 100644 --- a/data/2026/CVE-2026-44627.json +++ b/data/2026/CVE-2026-44627.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) oneAPI Deep Neural Network Library (oneDNN) software","vendor":"n/a","versions":[{"status":"affected","version":"before version v2026.0.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow to buffer overflow for some Intel(R) oneAPI Deep Neural Network Library (oneDNN) software before version v2026.0.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-44627","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:43.857","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01494.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-680"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) oneAPI Deep Neural Network Library (oneDNN) software","vendor":"n/a","versions":[{"status":"affected","version":"before version v2026.0.0"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow to buffer overflow for some Intel(R) oneAPI Deep Neural Network Library (oneDNN) software before version v2026.0.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-44627","lastModified":"2026-11-12T20:18:38.210","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-44627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:35.719876Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:43.857","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01494.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-680"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-44929.json b/data/2026/CVE-2026-44929.json index 8f44cdd846..9baa7361b6 100644 --- a/data/2026/CVE-2026-44929.json +++ b/data/2026/CVE-2026-44929.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-util","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-util","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-44929","lastModified":"2026-11-11T19:17:40.703","metrics":{},"published":"2026-11-11T15:17:23.290","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/BATIK-1393"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/d9zfzmjr8frhylopnq4r7ojwcfk9hbjg"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/17"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-util","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-util","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-44929","lastModified":"2026-11-12T17:01:06.913","metrics":{},"published":"2026-11-11T15:17:23.290","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/BATIK-1393"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/d9zfzmjr8frhylopnq4r7ojwcfk9hbjg"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/17"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-45146.json b/data/2026/CVE-2026-45146.json index 001513702d..015bda3934 100644 --- a/data/2026/CVE-2026-45146.json +++ b/data/2026/CVE-2026-45146.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"chamilo-lms","vendor":"chamilo","versions":[{"status":"affected","version":"< 1.11.40"},{"status":"affected","version":">= 2.0.0, < 2.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1."}],"id":"CVE-2026-45146","lastModified":"2026-11-09T16:17:33.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-45146","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:44:26.766208Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:13.943","references":[{"source":"security-advisories@github.com","url":"https://github.com/chamilo/chamilo-lms/commit/4472f3089bbbca1b4713bfd7059907676b80d07f"},{"source":"security-advisories@github.com","url":"https://github.com/chamilo/chamilo-lms/commit/7cc961d60ac27eaccd6bcc8db201de2c65adfdf3"},{"source":"security-advisories@github.com","url":"https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.40"},{"source":"security-advisories@github.com","url":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1"},{"source":"security-advisories@github.com","url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-prqp-8x29-cr88"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"chamilo-lms","vendor":"chamilo","versions":[{"status":"affected","version":"< 1.11.40"},{"status":"affected","version":">= 2.0.0, < 2.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1."}],"id":"CVE-2026-45146","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-45146","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:44:26.766208Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:13.943","references":[{"source":"security-advisories@github.com","url":"https://github.com/chamilo/chamilo-lms/commit/4472f3089bbbca1b4713bfd7059907676b80d07f"},{"source":"security-advisories@github.com","url":"https://github.com/chamilo/chamilo-lms/commit/7cc961d60ac27eaccd6bcc8db201de2c65adfdf3"},{"source":"security-advisories@github.com","url":"https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.40"},{"source":"security-advisories@github.com","url":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1"},{"source":"security-advisories@github.com","url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-prqp-8x29-cr88"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-45265.json b/data/2026/CVE-2026-45265.json new file mode 100644 index 0000000000..b6934393ba --- /dev/null +++ b/data/2026/CVE-2026-45265.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug is triggered on the real server side. A crafted request can set an excessively large RecordCount, which is later used as the loop bound for writing record data into a stack-allocated BACNET_ATOMIC_READ_FILE_DATA data structure. However, the stack object only has space for one fileData element. When the loop reaches i = 1, the code computes &data->fileData[1], which is already out of bounds, and the resulting invalid pointer is passed down to memmove(), causing a stack-buffer-overflow. This issue has been patched in versions 1.4.4 and 1.5.1."}],"id":"CVE-2026-45265","lastModified":"2026-11-12T20:18:38.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:38.380","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1340"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-v3gx-mwrp-xvh5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-45341.json b/data/2026/CVE-2026-45341.json new file mode 100644 index 0000000000..b221525784 --- /dev/null +++ b/data/2026/CVE-2026-45341.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":">= 1.4.0, < 1.4.4"},{"status":"affected","version":">= 1.5.0, < 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before 1.5.1, a NULL pointer dereference can be triggered in bacnet_device_object_reference_decode() when a WriteProperty request updates OBJECT_STRUCTURED_VIEW / PROP_SUBORDINATE_LIST. This issue has been patched in versions 1.4.4 and 1.5.1."}],"id":"CVE-2026-45341","lastModified":"2026-11-12T20:18:38.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:38.667","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-fv2r-c2m2-7qhh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-46487.json b/data/2026/CVE-2026-46487.json index 61aa5a02f0..468561af1b 100644 --- a/data/2026/CVE-2026-46487.json +++ b/data/2026/CVE-2026-46487.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"core-geonetwork","vendor":"geonetwork","versions":[{"status":"affected","version":">= 4.0.0-alpha.1, <= 4.0.6-0"},{"status":"affected","version":">= 4.2.0, < 4.2.16"},{"status":"affected","version":">= 4.4.0, < 4.4.11"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11."}],"id":"CVE-2026-46487","lastModified":"2026-11-07T04:17:30.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-46487","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:23:42.962146Z","version":"2.0.3"}}]},"published":"2026-11-03T19:18:05.933","references":[{"source":"security-advisories@github.com","url":"https://github.com/geonetwork/core-geonetwork/commit/1916412d38999f2eff68bad2dfccd69340d20f3f"},{"source":"security-advisories@github.com","url":"https://github.com/geonetwork/core-geonetwork/commit/6c756c63cd1fa942f3832d99c64380c69c5e8be9"},{"source":"security-advisories@github.com","url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16"},{"source":"security-advisories@github.com","url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11"},{"source":"security-advisories@github.com","url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"core-geonetwork","vendor":"geonetwork","versions":[{"status":"affected","version":">= 4.0.0-alpha.1, <= 4.0.6-0"},{"status":"affected","version":">= 4.2.0, < 4.2.16"},{"status":"affected","version":">= 4.4.0, < 4.4.11"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11."}],"id":"CVE-2026-46487","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-46487","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:23:42.962146Z","version":"2.0.3"}}]},"published":"2026-11-03T19:18:05.933","references":[{"source":"security-advisories@github.com","url":"https://github.com/geonetwork/core-geonetwork/commit/1916412d38999f2eff68bad2dfccd69340d20f3f"},{"source":"security-advisories@github.com","url":"https://github.com/geonetwork/core-geonetwork/commit/6c756c63cd1fa942f3832d99c64380c69c5e8be9"},{"source":"security-advisories@github.com","url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16"},{"source":"security-advisories@github.com","url":"https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11"},{"source":"security-advisories@github.com","url":"https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-46674.json b/data/2026/CVE-2026-46674.json new file mode 100644 index 0000000000..47cbbb4558 --- /dev/null +++ b/data/2026/CVE-2026-46674.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an externally controlled returnedRecordCount field and the fixed-size internal fileData[] array used by BACNET_ATOMIC_WRITE_FILE_DATA. This issue has been patched in versions 1.4.4 and 1.5.1."}],"id":"CVE-2026-46674","lastModified":"2026-11-12T20:18:39.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:39.080","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1344"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8384-pwhh-cxjh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-125"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-46676.json b/data/2026/CVE-2026-46676.json new file mode 100644 index 0000000000..88780379a6 --- /dev/null +++ b/data/2026/CVE-2026-46676.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":">= 1.4.0, < 1.4.4"},{"status":"affected","version":">= 1.5.0, < 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4, and 1.5.0 to before 1.5.1, an uninitialized value use vulnerability in bacnet-stack's AtomicReadFile record-access ACK encoder allows unauthenticated remote attackers to corrupt the encoded OCTET STRING length and payload boundary in network responses by sending a crafted AtomicReadFile request that reaches a successful record-access path. This issue has been patched in versions 1.4.4 and 1.5.1."}],"id":"CVE-2026-46676","lastModified":"2026-11-12T20:18:39.317","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:39.317","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1344"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2fwp-32cj-g3x4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-457"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-46677.json b/data/2026/CVE-2026-46677.json new file mode 100644 index 0000000000..fc8ee46b2b --- /dev/null +++ b/data/2026/CVE-2026-46677.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNET_ATOMIC_READ_FILE_DATA. The ACK decode path preserves the remote RecordCount, discards storage for excess records without truncating that count, and a downstream sink later iterates over the original RecordCount and indexes fileData[i] out of bounds. This issue has been patched in versions 1.4.4 and 1.5.1."}],"id":"CVE-2026-46677","lastModified":"2026-11-12T20:18:39.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:39.550","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1344"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rv5h-cxwq-q3mh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-130"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-47217.json b/data/2026/CVE-2026-47217.json new file mode 100644 index 0000000000..332dd221cb --- /dev/null +++ b/data/2026/CVE-2026-47217.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, a remote attacker can trigger an uncontrolled recursion and stack overflow in the default server application of bacnet-stack by abusing the Channel object. This issue has been patched in versions 1.4.4 and 1.5.1."}],"id":"CVE-2026-47217","lastModified":"2026-11-12T20:18:39.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:39.770","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1345"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-wjw5-q9g6-2764"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-754"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-47257.json b/data/2026/CVE-2026-47257.json new file mode 100644 index 0000000000..b06400a135 --- /dev/null +++ b/data/2026/CVE-2026-47257.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":">= 1.5.0, < 1.5.1"},{"status":"affected","version":">= 1.6.0-rc1, < 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. In versions 1.5.0 and 1.6.0-rc1, there is a restore logic flaw in bacnet-stack that is reachable through the official, unmodified apps/server management path when BACNET_BACKUP_RESTORE is enabled. This issue has been patched in versions 1.5.1 and 1.6.0."}],"id":"CVE-2026-47257","lastModified":"2026-11-12T20:18:40.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:40.020","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1352"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-x6pp-3pf3-f87r"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-670"},{"lang":"en","value":"CWE-754"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-47258.json b/data/2026/CVE-2026-47258.json new file mode 100644 index 0000000000..92f8388782 --- /dev/null +++ b/data/2026/CVE-2026-47258.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-based out-of-bounds write exists in the Notification Class object implementation when handling AddListElement for the recipient-list property. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0."}],"id":"CVE-2026-47258","lastModified":"2026-11-12T20:18:40.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:40.260","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1353"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rjmv-3mcm-r83j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-129"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-47259.json b/data/2026/CVE-2026-47259.json new file mode 100644 index 0000000000..3138727e71 --- /dev/null +++ b/data/2026/CVE-2026-47259.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0."}],"id":"CVE-2026-47259","lastModified":"2026-11-12T20:18:40.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:40.483","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1353"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9w9m-w7w5-rrv3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-4762.json b/data/2026/CVE-2026-4762.json index 939bb946f8..9cd2a069f7 100644 --- a/data/2026/CVE-2026-4762.json +++ b/data/2026/CVE-2026-4762.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.1","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability to perform a privilege escalation attack on the server as a non-admin user."}],"id":"CVE-2026-4762","lastModified":"2026-11-10T06:17:09.757","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:09.757","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/1f/4b/66/cve-2026-4762pdf-en-US-561246.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.1","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability to perform a privilege escalation attack on the server as a non-admin user."}],"id":"CVE-2026-4762","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4762","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:39:37.412746Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:09.757","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/1f/4b/66/cve-2026-4762pdf-en-US-561246.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-47710.json b/data/2026/CVE-2026-47710.json new file mode 100644 index 0000000000..b18cb0e806 --- /dev/null +++ b/data/2026/CVE-2026-47710.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-buffer-overflow can be triggered in the current master branch when a Loop object reads a referenced property through its default timer path and the referenced property is OBJECT_STRUCTURED_VIEW / PROP_DESCRIPTION containing a long attacker-controlled string. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0."}],"id":"CVE-2026-47710","lastModified":"2026-11-12T20:18:40.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:40.747","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1355"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2xm5-gjpc-9m6q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-47711.json b/data/2026/CVE-2026-47711.json new file mode 100644 index 0000000000..1490a6d444 --- /dev/null +++ b/data/2026/CVE-2026-47711.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0."}],"id":"CVE-2026-47711","lastModified":"2026-11-12T20:18:41.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:41.220","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-vrpm-9gm2-x552"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-131"},{"lang":"en","value":"CWE-787"},{"lang":"en","value":"CWE-805"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-48479.json b/data/2026/CVE-2026-48479.json index b3be8fb6eb..999886c915 100644 --- a/data/2026/CVE-2026-48479.json +++ b/data/2026/CVE-2026-48479.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R1000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Picasso\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized or invalid state in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of service."}],"id":"CVE-2026-48479","lastModified":"2026-11-11T14:17:41.107","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-11T14:17:41.107","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4026.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R1000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Picasso\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver Release Notes(73729e)"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized or invalid state in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of service."}],"id":"CVE-2026-48479","lastModified":"2026-11-12T16:58:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-11T14:17:41.107","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4026.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-49028.json b/data/2026/CVE-2026-49028.json index 8c23037f3f..d539923421 100644 --- a/data/2026/CVE-2026-49028.json +++ b/data/2026/CVE-2026-49028.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version 3.8"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-49028","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:44.120","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version 3.8"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-49028","lastModified":"2026-11-12T20:18:41.633","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-49028","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:38.579909Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:44.120","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-49236.json b/data/2026/CVE-2026-49236.json index 64b18c9f25..66f8c33e1b 100644 --- a/data/2026/CVE-2026-49236.json +++ b/data/2026/CVE-2026-49236.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-bridge","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-bridge","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-49236","lastModified":"2026-11-11T19:17:41.083","metrics":{},"published":"2026-11-11T14:17:43.253","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/BATIK-1394"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/xpysqx09ycpj23qk6b10k87pssqx0dk2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/18"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-bridge","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-bridge","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-49236","lastModified":"2026-11-12T17:01:06.913","metrics":{},"published":"2026-11-11T14:17:43.253","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/BATIK-1394"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/xpysqx09ycpj23qk6b10k87pssqx0dk2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/18"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-49272.json b/data/2026/CVE-2026-49272.json index ef9b97d0c0..2520b83a7b 100644 --- a/data/2026/CVE-2026-49272.json +++ b/data/2026/CVE-2026-49272.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"oauthlib","vendor":"oauthlib","versions":[{"status":"affected","version":">= 3.3.0, < 4.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid. A caller whose client request is accepted by the configured validator and who knows a valid client ID enabled for the device workflow can submit a missing or bogus device code to the token endpoint and obtain a bearer token without completing device authorization. This issue is fixed in version 4.0.1."}],"id":"CVE-2026-49272","lastModified":"2026-11-05T22:18:44.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-49272","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:14:28.774870Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:50.447","references":[{"source":"security-advisories@github.com","url":"https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114"},{"source":"security-advisories@github.com","url":"https://github.com/oauthlib/oauthlib/pull/954"},{"source":"security-advisories@github.com","url":"https://github.com/oauthlib/oauthlib/releases/tag/v4.0.1"},{"source":"security-advisories@github.com","url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"oauthlib","vendor":"oauthlib","versions":[{"status":"affected","version":">= 3.3.0, < 4.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validate_token_request to check that the device_code parameter is present and valid. A caller whose client request is accepted by the configured validator and who knows a valid client ID enabled for the device workflow can submit a missing or bogus device code to the token endpoint and obtain a bearer token without completing device authorization. This issue is fixed in version 4.0.1."}],"id":"CVE-2026-49272","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-49272","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:14:28.774870Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:50.447","references":[{"source":"security-advisories@github.com","url":"https://github.com/oauthlib/oauthlib/commit/77a5f1c8ce00da2b0b8c5f6e9cc129920085f114"},{"source":"security-advisories@github.com","url":"https://github.com/oauthlib/oauthlib/pull/954"},{"source":"security-advisories@github.com","url":"https://github.com/oauthlib/oauthlib/releases/tag/v4.0.1"},{"source":"security-advisories@github.com","url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-50077.json b/data/2026/CVE-2026-50077.json index 92a14c1dd9..4f4a0db565 100644 --- a/data/2026/CVE-2026-50077.json +++ b/data/2026/CVE-2026-50077.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Hypervisor","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX Hypervisor for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the QVM to cause memory corruption, information disclosure or a crash of the QVM."}],"id":"CVE-2026-50077","lastModified":"2026-11-10T20:19:12.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.1,"impactScore":6.0,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T20:19:12.123","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141343"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@blackberry.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Hypervisor","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX Hypervisor for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the QVM to cause memory corruption, information disclosure or a crash of the QVM."}],"id":"CVE-2026-50077","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.1,"impactScore":6.0,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T20:19:12.123","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141343"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@blackberry.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-50078.json b/data/2026/CVE-2026-50078.json index b2e47edb91..0f26d736a9 100644 --- a/data/2026/CVE-2026-50078.json +++ b/data/2026/CVE-2026-50078.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Hypervisor","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX Hypervisor for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QVM."}],"id":"CVE-2026-50078","lastModified":"2026-11-10T20:19:12.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T20:19:12.300","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141343"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@blackberry.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Hypervisor","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX Hypervisor for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QVM."}],"id":"CVE-2026-50078","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T20:19:12.300","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141343"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@blackberry.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-50079.json b/data/2026/CVE-2026-50079.json index 675f0e1020..64802c5bc2 100644 --- a/data/2026/CVE-2026-50079.json +++ b/data/2026/CVE-2026-50079.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Hypervisor","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX Hypervisor for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM."}],"id":"CVE-2026-50079","lastModified":"2026-11-10T20:19:12.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T20:19:12.443","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141343"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"secure@blackberry.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Hypervisor","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX Hypervisor for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM."}],"id":"CVE-2026-50079","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T20:19:12.443","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141343"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"secure@blackberry.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-50080.json b/data/2026/CVE-2026-50080.json index d389153895..2d4f8d5e6c 100644 --- a/data/2026/CVE-2026-50080.json +++ b/data/2026/CVE-2026-50080.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Hypervisor","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX Hypervisor for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACPI request."}],"id":"CVE-2026-50080","lastModified":"2026-11-10T20:19:12.567","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T20:19:12.567","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141343"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@blackberry.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Hypervisor","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]},{"defaultStatus":"unaffected","product":"QNX Hypervisor for Safety","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACPI request."}],"id":"CVE-2026-50080","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T20:19:12.567","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141343"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@blackberry.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-50109.json b/data/2026/CVE-2026-50109.json index 5f1639d910..c8eaa9c127 100644 --- a/data/2026/CVE-2026-50109.json +++ b/data/2026/CVE-2026-50109.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Performance Counter Monitor (Intel(R) PCM)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for some Intel(R) Performance Counter Monitor (Intel(R) PCM) within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-50109","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:44.267","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01528.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Performance Counter Monitor (Intel(R) PCM)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write for some Intel(R) Performance Counter Monitor (Intel(R) PCM) within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-50109","lastModified":"2026-11-12T20:18:41.970","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-50109","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:41.111646Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:44.267","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01528.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-50177.json b/data/2026/CVE-2026-50177.json index 1698dd83eb..35e7b632c6 100644 --- a/data/2026/CVE-2026-50177.json +++ b/data/2026/CVE-2026-50177.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version 3.8"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-50177","lastModified":"2026-11-10T22:06:38.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T17:17:44.407","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Neural Compressor software","vendor":"n/a","versions":[{"status":"affected","version":"before version 3.8"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-50177","lastModified":"2026-11-12T20:18:42.310","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-50177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:19:43.613293Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:44.407","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01490.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"secure@intel.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-50735.json b/data/2026/CVE-2026-50735.json index 13812e3faa..ed2ab33bec 100644 --- a/data/2026/CVE-2026-50735.json +++ b/data/2026/CVE-2026-50735.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"pglogical","vendor":"EnterpriseDB","versions":[{"lessThan":"2.4.8","status":"affected","version":"2","versionType":"semver"}]}],"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"DC0E75E2-2571-4AB8-892A-DA7B88B722EF","versionEndExcluding":"2.4.8","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."},{"lang":"es","value":"El worker de aplicación de pglogical no valida suficientemente la longitud de ciertos campos en los mensajes entrantes del protocolo de replicación antes de copiarlos, lo que resulta en una lectura fuera de límites. Una parte que actúa como publicador para una suscripción, por ejemplo, un endpoint que no es PostgreSQL y que habla el protocolo de replicación pglogical, puede devolver mensajes manipulados que hacen que el worker de aplicación del suscriptor lea más allá de los límites de un búfer asignado, revelando memoria de proceso adyacente o bloqueando el worker. Para explotar el problema, un atacante debe ser capaz de dirigir una suscripción a un endpoint que controlan. En instalaciones predeterminadas, esto requiere privilegios normalmente reservados para un superusuario, por lo que el problema es más relevante para implementaciones gestionadas donde la capacidad de crear suscripciones ha sido delegada a roles que no son de superusuario."}],"id":"CVE-2026-50735","lastModified":"2026-10-23T23:10:00.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-50735","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-28T18:58:57.167071Z","version":"2.0.3"}}]},"published":"2026-07-28T19:17:36.540","references":[{"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","tags":["Vendor Advisory"],"url":"https://www.enterprisedb.com/docs/security/advisories/cve202650735/"}],"sourceIdentifier":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"pglogical","vendor":"EnterpriseDB","versions":[{"lessThan":"2.4.8","status":"affected","version":"2","versionType":"semver"}]},{"defaultStatus":"unknown","product":"Spock","repo":"https://github.com/pgEdge/spock","vendor":"pgEdge","versions":[{"lessThanOrEqual":"3.3.6","status":"affected","version":"3","versionType":"custom"},{"status":"unaffected","version":"3.3.7","versionType":"custom"},{"lessThanOrEqual":"4.1.0.3","status":"affected","version":"4","versionType":"custom"},{"status":"unaffected","version":"4.1.1","versionType":"custom"},{"lessThanOrEqual":"5.0.11","status":"affected","version":"5","versionType":"custom"},{"status":"unaffected","version":"5.0.12","versionType":"custom"}]}],"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"DC0E75E2-2571-4AB8-892A-DA7B88B722EF","versionEndExcluding":"2.4.8","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."},{"lang":"es","value":"El worker de aplicación de pglogical no valida suficientemente la longitud de ciertos campos en los mensajes entrantes del protocolo de replicación antes de copiarlos, lo que resulta en una lectura fuera de límites. Una parte que actúa como publicador para una suscripción, por ejemplo, un endpoint que no es PostgreSQL y que habla el protocolo de replicación pglogical, puede devolver mensajes manipulados que hacen que el worker de aplicación del suscriptor lea más allá de los límites de un búfer asignado, revelando memoria de proceso adyacente o bloqueando el worker. Para explotar el problema, un atacante debe ser capaz de dirigir una suscripción a un endpoint que controlan. En instalaciones predeterminadas, esto requiere privilegios normalmente reservados para un superusuario, por lo que el problema es más relevante para implementaciones gestionadas donde la capacidad de crear suscripciones ha sido delegada a roles que no son de superusuario."}],"id":"CVE-2026-50735","lastModified":"2026-11-12T19:17:04.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-50735","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-28T18:58:57.167071Z","version":"2.0.3"}}]},"published":"2026-07-28T19:17:36.540","references":[{"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","url":"https://github.com/pgEdge/spock/security/advisories/GHSA-j2m3-f88h-2h46"},{"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","tags":["Vendor Advisory"],"url":"https://www.enterprisedb.com/docs/security/advisories/cve202650735/"}],"sourceIdentifier":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-52786.json b/data/2026/CVE-2026-52786.json new file mode 100644 index 0000000000..0880240ab2 --- /dev/null +++ b/data/2026/CVE-2026-52786.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK that contains more heading properties than the tool’s fixed local storage can hold. The response is decoded successfully and later consumed by ProcessRPMData(), which writes property values into a fixed global array using an unbounded linear index. This results in a reproducible global-buffer-overflow in apps/epics/main.c. This is a network-reachable memory corruption in the official epics tool’s response-processing path. The root cause is that apps/epics treats a remotely supplied variable-length RPM property list as if it were a trusted, fixed-size local heading-property set. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0."}],"id":"CVE-2026-52786","lastModified":"2026-11-12T20:18:42.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:42.493","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1366"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1409"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-c4q6-7827-mfg6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-54161.json b/data/2026/CVE-2026-54161.json index 871a6eb6ad..520d3294fd 100644 --- a/data/2026/CVE-2026-54161.json +++ b/data/2026/CVE-2026-54161.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"nut","vendor":"networkupstools","versions":[{"status":"affected","version":">= 2.8.3, <= 2.8.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6."}],"id":"CVE-2026-54161","lastModified":"2026-11-03T23:17:48.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-54161","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T22:36:38.962299Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:14.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7"},{"source":"security-advisories@github.com","url":"https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a"},{"source":"security-advisories@github.com","url":"https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220"},{"source":"security-advisories@github.com","url":"https://github.com/networkupstools/nut/pull/3499"},{"source":"security-advisories@github.com","url":"https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/07/01/10"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"nut","vendor":"networkupstools","versions":[{"status":"affected","version":">= 2.8.3, <= 2.8.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6."}],"id":"CVE-2026-54161","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-54161","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T22:36:38.962299Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:14.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7"},{"source":"security-advisories@github.com","url":"https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a"},{"source":"security-advisories@github.com","url":"https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220"},{"source":"security-advisories@github.com","url":"https://github.com/networkupstools/nut/pull/3499"},{"source":"security-advisories@github.com","url":"https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/07/01/10"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-54436.json b/data/2026/CVE-2026-54436.json index 969207ab34..11a0c28adc 100644 --- a/data/2026/CVE-2026-54436.json +++ b/data/2026/CVE-2026-54436.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Software Development Platform","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based Buffer\nOverflow in the io-char library's DCMD_CHR_WAITINFO devctl() handler could\nallow an attacker with local access to cause data tampering, arbitrary code\nexecution, or a crash in the Character I/O device driver."}],"id":"CVE-2026-54436","lastModified":"2026-11-10T19:21:16.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.4,"impactScore":5.9,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T19:21:16.513","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141341"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@blackberry.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Software Development Platform","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based Buffer\nOverflow in the io-char library's DCMD_CHR_WAITINFO devctl() handler could\nallow an attacker with local access to cause data tampering, arbitrary code\nexecution, or a crash in the Character I/O device driver."}],"id":"CVE-2026-54436","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.4,"impactScore":5.9,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T19:21:16.513","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141341"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@blackberry.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-54437.json b/data/2026/CVE-2026-54437.json index 6d6b91a970..d5ff879e00 100644 --- a/data/2026/CVE-2026-54437.json +++ b/data/2026/CVE-2026-54437.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Software Development Platform","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Input Validation in the io-char library's\nDCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access\nto cause data tampering in the memory input buffer of the Character I/O device\ndriver."}],"id":"CVE-2026-54437","lastModified":"2026-11-10T19:21:16.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T19:21:16.647","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141341"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"secure@blackberry.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"QNX Software Development Platform","vendor":"BlackBerry Ltd","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}]}],"source":"secure@blackberry.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Input Validation in the io-char library's\nDCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access\nto cause data tampering in the memory input buffer of the Character I/O device\ndriver."}],"id":"CVE-2026-54437","lastModified":"2026-11-12T19:34:34.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secure@blackberry.com","type":"Secondary"}]},"published":"2026-11-10T19:21:16.647","references":[{"source":"secure@blackberry.com","url":"https://support.blackberry.com/pkb/s/article/141341"}],"sourceIdentifier":"secure@blackberry.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"secure@blackberry.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-54442.json b/data/2026/CVE-2026-54442.json index 8a3579e681..9afb88c890 100644 --- a/data/2026/CVE-2026-54442.json +++ b/data/2026/CVE-2026-54442.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"emissary","vendor":"NationalSecurityAgency","versions":[{"status":"affected","version":"< 8.51.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0."}],"id":"CVE-2026-54442","lastModified":"2026-11-05T21:18:51.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-54442","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:02:51.528575Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:51.240","references":[{"source":"security-advisories@github.com","url":"https://github.com/NationalSecurityAgency/emissary/commit/e0179f7558cfb09a5bbc63a2f9fcb50f899768f6"},{"source":"security-advisories@github.com","url":"https://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0"},{"source":"security-advisories@github.com","url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"emissary","vendor":"NationalSecurityAgency","versions":[{"status":"affected","version":"< 8.51.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0."}],"id":"CVE-2026-54442","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-54442","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:02:51.528575Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:51.240","references":[{"source":"security-advisories@github.com","url":"https://github.com/NationalSecurityAgency/emissary/commit/e0179f7558cfb09a5bbc63a2f9fcb50f899768f6"},{"source":"security-advisories@github.com","url":"https://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0"},{"source":"security-advisories@github.com","url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-c6q7-wqw2-h65w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-55312.json b/data/2026/CVE-2026-55312.json index 6692502aa8..a933fbff38 100644 --- a/data/2026/CVE-2026-55312.json +++ b/data/2026/CVE-2026-55312.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In insert_node of remap.c, there is a possible way to trigger an out of bounds write in the address remapping table due to a non-heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55312","lastModified":"2026-11-10T21:46:36.610","metrics":{},"published":"2026-11-10T20:19:13.007","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In insert_node of remap.c, there is a possible way to trigger an out of bounds write in the address remapping table due to a non-heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55312","lastModified":"2026-11-12T20:18:42.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55312","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:17:10.678994Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.007","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-55321.json b/data/2026/CVE-2026-55321.json index 1935ba4fb0..c34856cfc7 100644 --- a/data/2026/CVE-2026-55321.json +++ b/data/2026/CVE-2026-55321.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In parse_prime256v1 of keymint_asn1.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-55321","lastModified":"2026-11-10T21:46:36.640","metrics":{},"published":"2026-11-10T20:19:13.320","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In parse_prime256v1 of keymint_asn1.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-55321","lastModified":"2026-11-12T20:18:43.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55321","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:17:07.490586Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.320","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-55344.json b/data/2026/CVE-2026-55344.json index eb44a67044..045bc9f765 100644 --- a/data/2026/CVE-2026-55344.json +++ b/data/2026/CVE-2026-55344.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-55344","lastModified":"2026-11-10T21:46:38.370","metrics":{},"published":"2026-11-10T20:19:13.533","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-55344","lastModified":"2026-11-12T20:18:43.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55344","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:17:04.102558Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:13.533","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-55367.json b/data/2026/CVE-2026-55367.json index 4d188b080e..b449ab7443 100644 --- a/data/2026/CVE-2026-55367.json +++ b/data/2026/CVE-2026-55367.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"h2o","vendor":"h2o","versions":[{"status":"affected","version":"< 4212ce114506a073505fd389db16ad2ba4e582a0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0."}],"id":"CVE-2026-55367","lastModified":"2026-11-05T20:17:58.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55367","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:59:16.316316Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:06.167","references":[{"source":"security-advisories@github.com","url":"https://github.com/h2o/h2o/commit/4212ce114506a073505fd389db16ad2ba4e582a0"},{"source":"security-advisories@github.com","url":"https://github.com/h2o/h2o/pull/3754"},{"source":"security-advisories@github.com","url":"https://github.com/h2o/h2o/security/advisories/GHSA-q342-qp8v-p44c"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"h2o","vendor":"h2o","versions":[{"status":"affected","version":"< 4212ce114506a073505fd389db16ad2ba4e582a0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0."}],"id":"CVE-2026-55367","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55367","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:59:16.316316Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:06.167","references":[{"source":"security-advisories@github.com","url":"https://github.com/h2o/h2o/commit/4212ce114506a073505fd389db16ad2ba4e582a0"},{"source":"security-advisories@github.com","url":"https://github.com/h2o/h2o/pull/3754"},{"source":"security-advisories@github.com","url":"https://github.com/h2o/h2o/security/advisories/GHSA-q342-qp8v-p44c"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-56292.json b/data/2026/CVE-2026-56292.json index c9970cc98e..8d32ae04b3 100644 --- a/data/2026/CVE-2026-56292.json +++ b/data/2026/CVE-2026-56292.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"acymailing.com AcyMailing extension for Joomla","vendor":"acymailing.com","versions":[{"status":"affected","version":"1.0-10.11.0"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:*:joomla\\!:*:*","matchCriteriaId":"74A0980A-A73E-4600-845C-9254A06D0922","versionEndExcluding":"10.11.1","versionStartIncluding":"6.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage."},{"lang":"es","value":"Una vulnerabilidad SQLi en el componente AcyMailing anterior a 10.11.1 para Joomla fue descubierta. Explotar esta falla puede llevar a acceso no autorizado a la base de datos y fuga de datos."}],"id":"CVE-2026-56292","lastModified":"2026-10-23T23:10:00.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-07-09T14:38:44.551666Z","version":"2.0.3"}}]},"published":"2026-07-09T15:16:37.937","references":[{"source":"security@joomla.org","tags":["Exploit","Third Party Advisory"],"url":"https://mysites.guru/blog/acymailing-sql-injection-disclosure/"},{"source":"security@joomla.org","tags":["Product"],"url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@joomla.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"acymailing.com AcyMailing extension for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0-10.11.0"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:*:joomla\\!:*:*","matchCriteriaId":"74A0980A-A73E-4600-845C-9254A06D0922","versionEndExcluding":"10.11.1","versionStartIncluding":"6.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage."},{"lang":"es","value":"Una vulnerabilidad SQLi en el componente AcyMailing anterior a 10.11.1 para Joomla fue descubierta. Explotar esta falla puede llevar a acceso no autorizado a la base de datos y fuga de datos."}],"id":"CVE-2026-56292","lastModified":"2026-11-12T19:17:04.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-07-09T14:38:44.551666Z","version":"2.0.3"}}]},"published":"2026-07-09T15:16:37.937","references":[{"source":"security@joomla.org","tags":["Exploit","Third Party Advisory"],"url":"https://mysites.guru/blog/acymailing-sql-injection-disclosure/"},{"source":"security@joomla.org","tags":["Product"],"url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-56712.json b/data/2026/CVE-2026-56712.json index 2dd46f7216..a756e9860d 100644 --- a/data/2026/CVE-2026-56712.json +++ b/data/2026/CVE-2026-56712.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/replicate/cog","product":"cog","repo":"https://github.com/replicate/cog","vendor":"replicate","versions":[{"lessThanOrEqual":"0.23.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP before fetching. Attackers can supply malicious URLs or exploit HTTP redirects in cog.File and cog.Path predictor inputs to force requests to internal addresses, potentially exposing sensitive internal services or credentials."}],"id":"CVE-2026-56712","lastModified":"2026-11-09T22:18:52.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T22:18:52.290","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SaiTeja-Erukude/CVE-2026-56712-cog-ssrf"},{"source":"disclosure@vulncheck.com","url":"https://github.com/replicate/cog/pull/3225"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/replicate-cog-ssrf-via-cog-file-and-cog-path-url-inputs"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/replicate/cog","product":"cog","repo":"https://github.com/replicate/cog","vendor":"replicate","versions":[{"lessThanOrEqual":"0.23.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP before fetching. Attackers can supply malicious URLs or exploit HTTP redirects in cog.File and cog.Path predictor inputs to force requests to internal addresses, potentially exposing sensitive internal services or credentials."}],"id":"CVE-2026-56712","lastModified":"2026-11-12T19:17:04.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56712","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:55:24.576343Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:52.290","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SaiTeja-Erukude/CVE-2026-56712-cog-ssrf"},{"source":"disclosure@vulncheck.com","url":"https://github.com/replicate/cog/pull/3225"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/replicate-cog-ssrf-via-cog-file-and-cog-path-url-inputs"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-56884.json b/data/2026/CVE-2026-56884.json index c5b07e75ba..0237441b06 100644 --- a/data/2026/CVE-2026-56884.json +++ b/data/2026/CVE-2026-56884.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalidated parameters due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56884","lastModified":"2026-11-11T05:19:46.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56884","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:14.267","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalidated parameters due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56884","lastModified":"2026-11-12T20:18:43.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56884","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:58:11.657118Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:14.267","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-56933.json b/data/2026/CVE-2026-56933.json index 4056ad7d05..120eaa658d 100644 --- a/data/2026/CVE-2026-56933.json +++ b/data/2026/CVE-2026-56933.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In RecordApTx of efw_ap_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56933","lastModified":"2026-11-10T21:46:38.617","metrics":{},"published":"2026-11-10T20:19:15.850","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In RecordApTx of efw_ap_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56933","lastModified":"2026-11-12T20:18:43.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56933","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:17:00.167774Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.850","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-57500.json b/data/2026/CVE-2026-57500.json index d9ab298631..42efebce05 100644 --- a/data/2026/CVE-2026-57500.json +++ b/data/2026/CVE-2026-57500.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"reva","vendor":"opencloud-eu","versions":[{"status":"affected","version":"< 2.40.5"},{"status":"affected","version":"< 2.46.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4."}],"id":"CVE-2026-57500","lastModified":"2026-11-11T19:17:42.413","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T19:17:42.413","references":[{"source":"security-advisories@github.com","url":"https://github.com/opencloud-eu/reva/security/advisories/GHSA-3v8c-738m-4gcj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"reva","vendor":"opencloud-eu","versions":[{"status":"affected","version":"< 2.40.5"},{"status":"affected","version":"< 2.46.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4."}],"id":"CVE-2026-57500","lastModified":"2026-11-12T18:17:50.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:14.371053Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:42.413","references":[{"source":"security-advisories@github.com","url":"https://github.com/opencloud-eu/reva/security/advisories/GHSA-3v8c-738m-4gcj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-57562.json b/data/2026/CVE-2026-57562.json index 657a7ea333..ad31967cb6 100644 --- a/data/2026/CVE-2026-57562.json +++ b/data/2026/CVE-2026-57562.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"readest","vendor":"readest","versions":[{"status":"affected","version":"< 0.11.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10."}],"id":"CVE-2026-57562","lastModified":"2026-11-05T21:18:51.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57562","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:17:29.620516Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:06.510","references":[{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/pull/4638"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/releases/tag/v0.11.10"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"readest","vendor":"readest","versions":[{"status":"affected","version":"< 0.11.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10."}],"id":"CVE-2026-57562","lastModified":"2026-11-12T19:13:56.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57562","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:17:29.620516Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:06.510","references":[{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/pull/4638"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/releases/tag/v0.11.10"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-57565.json b/data/2026/CVE-2026-57565.json index 510af12b5f..addbfd479e 100644 --- a/data/2026/CVE-2026-57565.json +++ b/data/2026/CVE-2026-57565.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"readest","vendor":"readest","versions":[{"status":"affected","version":"< 0.11.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10."}],"id":"CVE-2026-57565","lastModified":"2026-11-05T20:17:58.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57565","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:05:26.746679Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:06.680","references":[{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/pull/4638"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/releases/tag/v0.11.10"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/security/advisories/GHSA-mfmj-2frf-vhgw"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/readest/readest/security/advisories/GHSA-mfmj-2frf-vhgw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"readest","vendor":"readest","versions":[{"status":"affected","version":"< 0.11.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10."}],"id":"CVE-2026-57565","lastModified":"2026-11-12T19:13:56.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57565","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:05:26.746679Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:06.680","references":[{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/pull/4638"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/releases/tag/v0.11.10"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/security/advisories/GHSA-mfmj-2frf-vhgw"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/readest/readest/security/advisories/GHSA-mfmj-2frf-vhgw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-57566.json b/data/2026/CVE-2026-57566.json index e1d067cfe0..ade6338a4a 100644 --- a/data/2026/CVE-2026-57566.json +++ b/data/2026/CVE-2026-57566.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"readest","vendor":"readest","versions":[{"status":"affected","version":"< 0.11.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10."}],"id":"CVE-2026-57566","lastModified":"2026-11-05T20:17:58.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57566","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:04:36.472248Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:06.850","references":[{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/pull/4638"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/releases/tag/v0.11.10"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"readest","vendor":"readest","versions":[{"status":"affected","version":"< 0.11.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10."}],"id":"CVE-2026-57566","lastModified":"2026-11-12T19:13:56.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57566","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:04:36.472248Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:06.850","references":[{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/pull/4638"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/releases/tag/v0.11.10"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-57567.json b/data/2026/CVE-2026-57567.json index 5e30cdcd7d..aa08511a18 100644 --- a/data/2026/CVE-2026-57567.json +++ b/data/2026/CVE-2026-57567.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"readest","vendor":"readest","versions":[{"status":"affected","version":"< 0.11.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10."}],"id":"CVE-2026-57567","lastModified":"2026-11-05T20:17:59.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57567","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:03:07.789551Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:07.013","references":[{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/pull/4639"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/pull/4651"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/releases/tag/v0.11.10"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"readest","vendor":"readest","versions":[{"status":"affected","version":"< 0.11.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10."}],"id":"CVE-2026-57567","lastModified":"2026-11-12T19:13:56.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57567","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:03:07.789551Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:07.013","references":[{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/pull/4639"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/pull/4651"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/releases/tag/v0.11.10"},{"source":"security-advisories@github.com","url":"https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-57845.json b/data/2026/CVE-2026-57845.json index 60c576ddd4..eb1d692f39 100644 --- a/data/2026/CVE-2026-57845.json +++ b/data/2026/CVE-2026-57845.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageURL":"pkg:github/huggingface/datasets","product":"datasets","repo":"https://github.com/huggingface/datasets","vendor":"huggingface","versions":[{"lessThanOrEqual":"5.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset(\"pandas\", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges."}],"id":"CVE-2026-57845","lastModified":"2026-10-29T18:17:33.640","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57845","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-29T17:58:18.702571Z","version":"2.0.3"}}]},"published":"2026-10-23T16:16:52.000","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SaiTeja-Erukude/CVE-2026-57845-hf-datasets-rce"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huggingface/datasets/pull/8879"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/hugging-face-datasets-pickle-deserialization-rce-via-pandas-builder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageURL":"pkg:github/huggingface/datasets","product":"datasets","repo":"https://github.com/huggingface/datasets","vendor":"huggingface","versions":[{"lessThanOrEqual":"5.1.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"5.2.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hugging Face Datasets before 5.2.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset(\"pandas\", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges."}],"id":"CVE-2026-57845","lastModified":"2026-11-12T19:17:04.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57845","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-29T17:58:18.702571Z","version":"2.0.3"}}]},"published":"2026-10-23T16:16:52.000","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SaiTeja-Erukude/CVE-2026-57845-hf-datasets-rce"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huggingface/datasets/pull/8879"},{"source":"disclosure@vulncheck.com","url":"https://github.com/huggingface/datasets/releases/tag/5.2.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/hugging-face-datasets-pickle-deserialization-rce-via-pandas-builder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-57907.json b/data/2026/CVE-2026-57907.json index 6724b1f13a..f48cb26939 100644 --- a/data/2026/CVE-2026-57907.json +++ b/data/2026/CVE-2026-57907.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Endpoint Security","vendor":"WatchGuard","versions":[{"lessThan":"8.00.26.0011","status":"affected","version":"0","versionType":"semver"}]}],"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process and issuing privileged commands to the service."}],"id":"CVE-2026-57907","lastModified":"2026-11-10T17:17:44.877","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57907","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:01:37.192902Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:44.877","references":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","url":"https://psirt.watchguard.com/CVE-2026-57907"}],"sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Endpoint Security","vendor":"WatchGuard","versions":[{"lessThan":"8.00.26.0011","status":"affected","version":"0","versionType":"semver"}]}],"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process and issuing privileged commands to the service."}],"id":"CVE-2026-57907","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57907","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:01:37.192902Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:44.877","references":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","url":"https://psirt.watchguard.com/CVE-2026-57907"}],"sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-58690.json b/data/2026/CVE-2026-58690.json index 066b76c4ac..e997d32d74 100644 --- a/data/2026/CVE-2026-58690.json +++ b/data/2026/CVE-2026-58690.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of bitmap_image_buffer.h, there is a possible way to trigger an out of bounds write on the trusted execution environment heap due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58690","lastModified":"2026-11-10T21:46:32.333","metrics":{},"published":"2026-11-10T20:19:23.417","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of bitmap_image_buffer.h, there is a possible way to trigger an out of bounds write on the trusted execution environment heap due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58690","lastModified":"2026-11-12T20:18:44.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:25:33.775148Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:23.417","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-58697.json b/data/2026/CVE-2026-58697.json index 66b1cb4257..4235fc65f0 100644 --- a/data/2026/CVE-2026-58697.json +++ b/data/2026/CVE-2026-58697.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In codec3p_secure of codec3p_secure, there is a possible Heap Buffer Overflow due to a missing bounds check. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58697","lastModified":"2026-11-10T21:46:42.783","metrics":{},"published":"2026-11-10T20:19:23.667","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In codec3p_secure of codec3p_secure, there is a possible Heap Buffer Overflow due to a missing bounds check. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58697","lastModified":"2026-11-12T20:18:44.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:56.859761Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:23.667","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-58757.json b/data/2026/CVE-2026-58757.json index a0a8b15cd3..178134b302 100644 --- a/data/2026/CVE-2026-58757.json +++ b/data/2026/CVE-2026-58757.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In mfc_alloc_enc_roi_buffer of mfc_buf.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58757","lastModified":"2026-11-10T21:46:38.970","metrics":{},"published":"2026-11-10T20:19:24.770","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In mfc_alloc_enc_roi_buffer of mfc_buf.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58757","lastModified":"2026-11-12T20:18:44.517","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58757","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:53.773541Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:24.770","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-58786.json b/data/2026/CVE-2026-58786.json index 856a80ee36..08affc8cd8 100644 --- a/data/2026/CVE-2026-58786.json +++ b/data/2026/CVE-2026-58786.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In cnm_memset of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58786","lastModified":"2026-11-10T21:46:39.097","metrics":{},"published":"2026-11-10T20:19:25.897","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In cnm_memset of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58786","lastModified":"2026-11-12T20:18:44.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58786","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:50.521080Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:25.897","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-58788.json b/data/2026/CVE-2026-58788.json index 5a1f7e842a..bfa7c24127 100644 --- a/data/2026/CVE-2026-58788.json +++ b/data/2026/CVE-2026-58788.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In stpropnci_process_std of stpropnci_std.cc, there is a possible way to trigger an out of bounds write into global state due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58788","lastModified":"2026-11-10T21:46:42.807","metrics":{},"published":"2026-11-10T20:19:26.187","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In stpropnci_process_std of stpropnci_std.cc, there is a possible way to trigger an out of bounds write into global state due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58788","lastModified":"2026-11-12T20:18:45.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58788","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:32:36.846730Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.187","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-58790.json b/data/2026/CVE-2026-58790.json index 5329517ee1..95c45fedfb 100644 --- a/data/2026/CVE-2026-58790.json +++ b/data/2026/CVE-2026-58790.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In CMD_ENC_SET_PARAM of encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58790","lastModified":"2026-11-10T21:46:32.473","metrics":{},"published":"2026-11-10T20:19:26.403","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In CMD_ENC_SET_PARAM of encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58790","lastModified":"2026-11-12T20:18:45.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58790","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:47.377062Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.403","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-58791.json b/data/2026/CVE-2026-58791.json index 51cc498474..e80b24a74d 100644 --- a/data/2026/CVE-2026-58791.json +++ b/data/2026/CVE-2026-58791.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In pic_timing of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58791","lastModified":"2026-11-10T21:46:36.840","metrics":{},"published":"2026-11-10T20:19:26.523","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In pic_timing of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58791","lastModified":"2026-11-12T20:18:45.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58791","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:44.201000Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.523","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-58804.json b/data/2026/CVE-2026-58804.json index 83875bcf8b..233b6378bc 100644 --- a/data/2026/CVE-2026-58804.json +++ b/data/2026/CVE-2026-58804.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ExecuteGraphCommand of multiple files, there is a possible way to trigger an out of bounds write via an oversized scratch memory declaration due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58804","lastModified":"2026-11-10T21:46:32.517","metrics":{},"published":"2026-11-10T20:19:27.377","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ExecuteGraphCommand of multiple files, there is a possible way to trigger an out of bounds write via an oversized scratch memory declaration due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58804","lastModified":"2026-11-12T20:18:45.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:38:30.114734Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:27.377","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-58813.json b/data/2026/CVE-2026-58813.json index 32ac3afd35..2a30f511f8 100644 --- a/data/2026/CVE-2026-58813.json +++ b/data/2026/CVE-2026-58813.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In mmap of mman.c, there is a possible way to trigger an out of bounds read and write via mapping size truncation due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58813","lastModified":"2026-11-11T05:19:48.980","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58813","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:28.343","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In mmap of mman.c, there is a possible way to trigger an out of bounds read and write via mapping size truncation due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58813","lastModified":"2026-11-12T19:17:05.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58813","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:58:22.613236Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:28.343","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59104.json b/data/2026/CVE-2026-59104.json index 12dd3fdef3..fa50dc3f22 100644 --- a/data/2026/CVE-2026-59104.json +++ b/data/2026/CVE-2026-59104.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"product":"UgCS","vendor":"SPH Engineering","versions":[{"lessThan":"6.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \\\"use the only user\\\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes."}],"id":"CVE-2026-59104","lastModified":"2026-11-10T15:17:28.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59104","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:16:05.468911Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:59.043","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://offseq.com/en/research/ugcs-cve-2026-59104/"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.ugcs.com/"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"product":"UgCS","vendor":"SPH Engineering","versions":[{"lessThan":"6.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \\\"use the only user\\\" rather than as invalid credentials, and the server returns a fully authenticated session. Because the service listens on all interfaces (0.0.0.0) without TLS by default, an unauthenticated remote attacker with network access to port 3334 can obtain an authenticated session without knowing any credential and then issue privileged commands, including commanding connected drones and uploading flight routes."}],"id":"CVE-2026-59104","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59104","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:16:05.468911Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:59.043","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://offseq.com/en/research/ugcs-cve-2026-59104/"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.ugcs.com/"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59105.json b/data/2026/CVE-2026-59105.json index 5406061f7a..ba9788d262 100644 --- a/data/2026/CVE-2026-59105.json +++ b/data/2026/CVE-2026-59105.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Jumis","vendor":"Jumis Pro SIA","versions":[{"lessThan":"TJ7.0.141.36","status":"affected","version":"0","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and is identical across every installation; it contains a hard-coded secret key for entropy. Because the only input (the server name) is not secret - the instance suffix is hard-coded and the host name is discoverable via the SQL Server Browser service (UDP 1434), the TDS pre-login response, or DNS/NetBIOS - any party able to reach a Jumis SQL Server can compute the password offline and authenticate. The ##Tilde_JumisAdmin## login is a member of the sysadmin server role. Successful authentication therefore grants full administrative control of the SQL Server instance and read/write access to every customer's accounting database hosted on it. The on-premise server installation also programmatically enables xp_cmdshell during routine operation, so sysadmin access escalates to operating-system command execution on the database server."}],"id":"CVE-2026-59105","lastModified":"2026-11-06T16:18:57.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59105","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T14:55:12.625794Z","version":"2.0.3"}}]},"published":"2026-11-06T15:17:22.270","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://offseq.com/en/research/jumis-cve-2026-59105/"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.mansjumis.lv/"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-547"},{"lang":"en","value":"CWE-1391"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Jumis","vendor":"Jumis Pro SIA","versions":[{"lessThan":"TJ7.0.141.36","status":"affected","version":"0","versionType":"custom"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and is identical across every installation; it contains a hard-coded secret key for entropy. Because the only input (the server name) is not secret - the instance suffix is hard-coded and the host name is discoverable via the SQL Server Browser service (UDP 1434), the TDS pre-login response, or DNS/NetBIOS - any party able to reach a Jumis SQL Server can compute the password offline and authenticate. The ##Tilde_JumisAdmin## login is a member of the sysadmin server role. Successful authentication therefore grants full administrative control of the SQL Server instance and read/write access to every customer's accounting database hosted on it. The on-premise server installation also programmatically enables xp_cmdshell during routine operation, so sysadmin access escalates to operating-system command execution on the database server."}],"id":"CVE-2026-59105","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59105","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T14:55:12.625794Z","version":"2.0.3"}}]},"published":"2026-11-06T15:17:22.270","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://offseq.com/en/research/jumis-cve-2026-59105/"},{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","url":"https://www.mansjumis.lv/"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-547"},{"lang":"en","value":"CWE-1391"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59191.json b/data/2026/CVE-2026-59191.json index f314827501..6ffc8928a9 100644 --- a/data/2026/CVE-2026-59191.json +++ b/data/2026/CVE-2026-59191.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"twig-view","vendor":"cakephp","versions":[{"status":"affected","version":"< 1.3.3"},{"status":"affected","version":">= 2.0.0, < 2.1.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate() is supplied un-validated user controlled data, arbitrary files can be read. This issue has been patched in versions 1.3.3 and 2.1.2."}],"id":"CVE-2026-59191","lastModified":"2026-11-11T05:19:49.280","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:49.280","references":[{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/releases/tag/1.3.3"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/releases/tag/2.1.2"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/security/advisories/GHSA-hq9r-72jq-2pxp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"twig-view","vendor":"cakephp","versions":[{"status":"affected","version":"< 1.3.3"},{"status":"affected","version":">= 2.0.0, < 2.1.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate() is supplied un-validated user controlled data, arbitrary files can be read. This issue has been patched in versions 1.3.3 and 2.1.2."}],"id":"CVE-2026-59191","lastModified":"2026-11-12T18:17:50.467","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59191","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:57.947524Z","version":"2.0.3"}}]},"published":"2026-11-11T05:19:49.280","references":[{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/releases/tag/1.3.3"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/releases/tag/2.1.2"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/security/advisories/GHSA-hq9r-72jq-2pxp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59573.json b/data/2026/CVE-2026-59573.json index dcb6dcd312..e7914466f9 100644 --- a/data/2026/CVE-2026-59573.json +++ b/data/2026/CVE-2026-59573.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In max_num_ref_frames of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59573","lastModified":"2026-11-10T21:46:39.533","metrics":{},"published":"2026-11-10T20:19:28.660","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In max_num_ref_frames of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59573","lastModified":"2026-11-12T20:18:46.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:40.885563Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:28.660","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59578.json b/data/2026/CVE-2026-59578.json index c78924ffd5..ceb0793147 100644 --- a/data/2026/CVE-2026-59578.json +++ b/data/2026/CVE-2026-59578.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In s_check_valid_tile_param_custom_tile of av1_encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59578","lastModified":"2026-11-10T21:46:39.630","metrics":{},"published":"2026-11-10T20:19:28.977","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In s_check_valid_tile_param_custom_tile of av1_encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59578","lastModified":"2026-11-12T20:18:46.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59578","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:37.615187Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:28.977","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59587.json b/data/2026/CVE-2026-59587.json index 8546d131d6..1ade18c799 100644 --- a/data/2026/CVE-2026-59587.json +++ b/data/2026/CVE-2026-59587.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In stpropnci_prop_st_build_set_custom_polling_cmd of stpropnci_prop_st.cc, there is a possible way to trigger an out of bounds write into global memory due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59587","lastModified":"2026-11-10T21:46:39.870","metrics":{},"published":"2026-11-10T20:19:29.677","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In stpropnci_prop_st_build_set_custom_polling_cmd of stpropnci_prop_st.cc, there is a possible way to trigger an out of bounds write into global memory due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59587","lastModified":"2026-11-12T20:18:46.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:46:04.082655Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:29.677","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59589.json b/data/2026/CVE-2026-59589.json index 8d4fa83cfe..1b1255b8f0 100644 --- a/data/2026/CVE-2026-59589.json +++ b/data/2026/CVE-2026-59589.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In s_av1_dec_metadata_scalability of av1_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59589","lastModified":"2026-11-10T21:46:39.910","metrics":{},"published":"2026-11-10T20:19:29.780","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In s_av1_dec_metadata_scalability of av1_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59589","lastModified":"2026-11-12T20:18:46.973","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:34.306227Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:29.780","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59593.json b/data/2026/CVE-2026-59593.json index da10402927..991ec42c6f 100644 --- a/data/2026/CVE-2026-59593.json +++ b/data/2026/CVE-2026-59593.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In tile_info of av1_decoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59593","lastModified":"2026-11-10T21:46:32.597","metrics":{},"published":"2026-11-10T20:19:29.920","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In tile_info of av1_decoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59593","lastModified":"2026-11-12T20:18:47.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59593","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:12:05.766875Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:29.920","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59594.json b/data/2026/CVE-2026-59594.json index 138d081ac3..e7bff21522 100644 --- a/data/2026/CVE-2026-59594.json +++ b/data/2026/CVE-2026-59594.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In spm_alloc of encoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59594","lastModified":"2026-11-10T21:46:32.610","metrics":{},"published":"2026-11-10T20:19:30.020","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In spm_alloc of encoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59594","lastModified":"2026-11-12T19:17:05.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:10:47.145302Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:30.020","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59596.json b/data/2026/CVE-2026-59596.json index eee841b5a8..82ac3173e1 100644 --- a/data/2026/CVE-2026-59596.json +++ b/data/2026/CVE-2026-59596.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59596","lastModified":"2026-11-10T21:46:32.637","metrics":{},"published":"2026-11-10T20:19:30.227","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59596","lastModified":"2026-11-12T20:18:47.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59596","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:30:37.005934Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:30.227","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-453"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59608.json b/data/2026/CVE-2026-59608.json index 8d1d7fd98d..bf148ba062 100644 --- a/data/2026/CVE-2026-59608.json +++ b/data/2026/CVE-2026-59608.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In tone_mapping_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59608","lastModified":"2026-11-10T21:46:34.230","metrics":{},"published":"2026-11-10T20:19:31.177","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In tone_mapping_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59608","lastModified":"2026-11-12T20:18:47.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59608","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:31.220708Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:31.177","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59612.json b/data/2026/CVE-2026-59612.json index 8b5375068b..ee2f0683cf 100644 --- a/data/2026/CVE-2026-59612.json +++ b/data/2026/CVE-2026-59612.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In buffering_period of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59612","lastModified":"2026-11-10T21:46:40.130","metrics":{},"published":"2026-11-10T20:19:31.493","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In buffering_period of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59612","lastModified":"2026-11-12T20:18:47.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:27.310785Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:31.493","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59616.json b/data/2026/CVE-2026-59616.json index b2ab9a5c24..396edb4f5f 100644 --- a/data/2026/CVE-2026-59616.json +++ b/data/2026/CVE-2026-59616.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In prev_run_vcore of hwcodec_firmware, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59616","lastModified":"2026-11-10T21:46:34.277","metrics":{},"published":"2026-11-10T20:19:31.827","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In prev_run_vcore of hwcodec_firmware, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59616","lastModified":"2026-11-12T20:18:48.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59616","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:23.955538Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:31.827","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59631.json b/data/2026/CVE-2026-59631.json index 8efb702124..710d52a9c6 100644 --- a/data/2026/CVE-2026-59631.json +++ b/data/2026/CVE-2026-59631.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In s_inter_rps_pred of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59631","lastModified":"2026-11-10T21:46:32.770","metrics":{},"published":"2026-11-10T20:19:32.753","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In s_inter_rps_pred of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59631","lastModified":"2026-11-12T20:18:48.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59631","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:20.433619Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:32.753","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-59635.json b/data/2026/CVE-2026-59635.json index 159ce51682..3115a18d10 100644 --- a/data/2026/CVE-2026-59635.json +++ b/data/2026/CVE-2026-59635.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59635","lastModified":"2026-11-10T21:46:42.843","metrics":{},"published":"2026-11-10T20:19:32.973","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59635","lastModified":"2026-11-12T20:18:48.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59635","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:16.986849Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:32.973","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-60035.json b/data/2026/CVE-2026-60035.json index 50ee93de3b..377ca207af 100644 --- a/data/2026/CVE-2026-60035.json +++ b/data/2026/CVE-2026-60035.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60035","lastModified":"2026-11-10T09:17:22.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:22.783","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform a code injection in the backends network auth function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60035","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:22.783","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-60036.json b/data/2026/CVE-2026-60036.json index d63b648b4d..ca973a5b6a 100644 --- a/data/2026/CVE-2026-60036.json +++ b/data/2026/CVE-2026-60036.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60036","lastModified":"2026-11-10T17:17:45.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:37:10.906823Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:22.963","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60036","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:37:10.906823Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:22.963","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-60037.json b/data/2026/CVE-2026-60037.json index 8418417043..c98bd9e360 100644 --- a/data/2026/CVE-2026-60037.json +++ b/data/2026/CVE-2026-60037.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60037","lastModified":"2026-11-10T15:17:28.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60037","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:12:24.633441Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:23.133","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60037","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60037","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:12:24.633441Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:23.133","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-60038.json b/data/2026/CVE-2026-60038.json index 6a26b8bc31..c3d66fa78f 100644 --- a/data/2026/CVE-2026-60038.json +++ b/data/2026/CVE-2026-60038.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60038","lastModified":"2026-11-10T19:21:16.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60038","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:02:20.766770Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:23.300","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60038","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60038","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:02:20.766770Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:23.300","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-60039.json b/data/2026/CVE-2026-60039.json index 1b64f26dfc..2c141ead9d 100644 --- a/data/2026/CVE-2026-60039.json +++ b/data/2026/CVE-2026-60039.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60039","lastModified":"2026-11-10T09:17:23.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:23.463","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability."}],"id":"CVE-2026-60039","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:23.463","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"info@cert.vde.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-60040.json b/data/2026/CVE-2026-60040.json index 0dfa33e0d9..a901b7cd6a 100644 --- a/data/2026/CVE-2026-60040.json +++ b/data/2026/CVE-2026-60040.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability."}],"id":"CVE-2026-60040","lastModified":"2026-11-10T09:17:23.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:23.610","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"info@cert.vde.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability."}],"id":"CVE-2026-60040","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:23.610","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"info@cert.vde.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-60041.json b/data/2026/CVE-2026-60041.json index 6f150195a8..0a2df5b08e 100644 --- a/data/2026/CVE-2026-60041.json +++ b/data/2026/CVE-2026-60041.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability."}],"id":"CVE-2026-60041","lastModified":"2026-11-10T17:17:45.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60041","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:37:33.942460Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:23.770","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability."}],"id":"CVE-2026-60041","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60041","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:37:33.942460Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:23.770","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-60042.json b/data/2026/CVE-2026-60042.json index dba573db53..d717c56700 100644 --- a/data/2026/CVE-2026-60042.json +++ b/data/2026/CVE-2026-60042.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially triggering traffic on other systems and email alerts. This can result in some loss of availability due to higher system loads."}],"id":"CVE-2026-60042","lastModified":"2026-11-10T15:17:28.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60042","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:11:14.441912Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:23.937","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially triggering traffic on other systems and email alerts. This can result in some loss of availability due to higher system loads."}],"id":"CVE-2026-60042","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60042","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:11:14.441912Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:23.937","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-60043.json b/data/2026/CVE-2026-60043.json index aeb893e902..2f56b98f93 100644 --- a/data/2026/CVE-2026-60043.json +++ b/data/2026/CVE-2026-60043.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability."}],"id":"CVE-2026-60043","lastModified":"2026-11-10T09:17:24.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.8,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:24.110","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"info@cert.vde.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability."}],"id":"CVE-2026-60043","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.8,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60043","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:44.132180Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:24.110","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-60044.json b/data/2026/CVE-2026-60044.json index fddc16a0af..196ff7b1e4 100644 --- a/data/2026/CVE-2026-60044.json +++ b/data/2026/CVE-2026-60044.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality."}],"id":"CVE-2026-60044","lastModified":"2026-11-10T09:17:24.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:24.307","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1393"}],"source":"info@cert.vde.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality."}],"id":"CVE-2026-60044","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:24.307","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1393"}],"source":"info@cert.vde.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-60045.json b/data/2026/CVE-2026-60045.json index 277047c694..4ac8921a24 100644 --- a/data/2026/CVE-2026-60045.json +++ b/data/2026/CVE-2026-60045.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities."}],"id":"CVE-2026-60045","lastModified":"2026-11-10T09:17:24.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:24.470","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"info@cert.vde.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities."}],"id":"CVE-2026-60045","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-10T09:17:24.470","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"info@cert.vde.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-60046.json b/data/2026/CVE-2026-60046.json index 707dfd617f..39a17f6658 100644 --- a/data/2026/CVE-2026-60046.json +++ b/data/2026/CVE-2026-60046.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted."}],"id":"CVE-2026-60046","lastModified":"2026-11-10T17:17:45.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60046","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:37:55.187212Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:24.617","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThan":"2.21.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted."}],"id":"CVE-2026-60046","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"info@cert.vde.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60046","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:37:55.187212Z","version":"2.0.3"}}]},"published":"2026-11-10T09:17:24.617","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-079/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-141/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-61470.json b/data/2026/CVE-2026-61470.json index 07a6f53cd5..00659a0d26 100644 --- a/data/2026/CVE-2026-61470.json +++ b/data/2026/CVE-2026-61470.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper control of a resource through its lifetime in the MigTD's TLS client for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable data corruption. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-61470","lastModified":"2026-11-10T18:17:44.423","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:44.423","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-664"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper control of a resource through its lifetime in the MigTD's TLS client for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable data corruption. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-61470","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:44.423","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-664"}],"source":"secure@intel.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-61473.json b/data/2026/CVE-2026-61473.json index 3d86f49c72..a51892e4e4 100644 --- a/data/2026/CVE-2026-61473.json +++ b/data/2026/CVE-2026-61473.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by capture-replay in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts."}],"id":"CVE-2026-61473","lastModified":"2026-11-10T18:17:44.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:44.563","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-294"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by capture-replay in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts."}],"id":"CVE-2026-61473","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:44.563","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-294"}],"source":"secure@intel.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-61619.json b/data/2026/CVE-2026-61619.json index 0df9f88d0c..3ae5ca04dd 100644 --- a/data/2026/CVE-2026-61619.json +++ b/data/2026/CVE-2026-61619.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"coreruleset","vendor":"coreruleset","versions":[{"status":"affected","version":"< 3.3.10"},{"status":"affected","version":"< 4.25.1"},{"status":"affected","version":"< 4.28.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0."}],"id":"CVE-2026-61619","lastModified":"2026-11-11T18:19:47.443","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T18:19:47.443","references":[{"source":"security-advisories@github.com","url":"https://github.com/coreruleset/coreruleset/commit/4665b6d7a79a81aa8a802ef3c901d69491c009a4"},{"source":"security-advisories@github.com","url":"https://github.com/coreruleset/coreruleset/commit/6083611d00291e85ab7b587e96577deb53ed9cac"},{"source":"security-advisories@github.com","url":"https://github.com/coreruleset/coreruleset/commit/e3b612a909532dcc8d056c01ac04b31117b71505"},{"source":"security-advisories@github.com","url":"https://github.com/coreruleset/coreruleset/security/advisories/GHSA-f5qm-3h4p-8qhg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"coreruleset","vendor":"coreruleset","versions":[{"status":"affected","version":"< 3.3.10"},{"status":"affected","version":"< 4.25.1"},{"status":"affected","version":"< 4.28.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0."}],"id":"CVE-2026-61619","lastModified":"2026-11-12T18:17:50.703","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61619","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:05.748514Z","version":"2.0.3"}}]},"published":"2026-11-11T18:19:47.443","references":[{"source":"security-advisories@github.com","url":"https://github.com/coreruleset/coreruleset/commit/4665b6d7a79a81aa8a802ef3c901d69491c009a4"},{"source":"security-advisories@github.com","url":"https://github.com/coreruleset/coreruleset/commit/6083611d00291e85ab7b587e96577deb53ed9cac"},{"source":"security-advisories@github.com","url":"https://github.com/coreruleset/coreruleset/commit/e3b612a909532dcc8d056c01ac04b31117b71505"},{"source":"security-advisories@github.com","url":"https://github.com/coreruleset/coreruleset/security/advisories/GHSA-f5qm-3h4p-8qhg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-61637.json b/data/2026/CVE-2026-61637.json index 6837516174..718aaa0821 100644 --- a/data/2026/CVE-2026-61637.json +++ b/data/2026/CVE-2026-61637.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"icingaweb2","vendor":"Icinga","versions":[{"status":"affected","version":"< 2.12.7"},{"status":"affected","version":"< 2.13.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1."}],"id":"CVE-2026-61637","lastModified":"2026-11-11T19:17:42.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T19:17:42.887","references":[{"source":"security-advisories@github.com","url":"https://github.com/Icinga/icingaweb2/security/advisories/GHSA-w7c2-xjv9-q8fv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"icingaweb2","vendor":"Icinga","versions":[{"status":"affected","version":"< 2.12.7"},{"status":"affected","version":"< 2.13.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1."}],"id":"CVE-2026-61637","lastModified":"2026-11-12T20:18:48.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61637","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:40:03.863019Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:42.887","references":[{"source":"security-advisories@github.com","url":"https://github.com/Icinga/icingaweb2/security/advisories/GHSA-w7c2-xjv9-q8fv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-61813.json b/data/2026/CVE-2026-61813.json index d3507dfb64..bdae24bb6d 100644 --- a/data/2026/CVE-2026-61813.json +++ b/data/2026/CVE-2026-61813.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":"< 2.9.15"},{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17."}],"id":"CVE-2026-61813","lastModified":"2026-11-09T17:17:31.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61813","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:10:12.729362Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:47.797","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":"< 2.9.15"},{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17."}],"id":"CVE-2026-61813","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61813","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:10:12.729362Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:47.797","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/cce204806430e4848327aadeb9113e654631a0c1"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/edca70d853bfb725325137fa40d178beebc324fc"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-2vqc-36qp-ccmw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-61887.json b/data/2026/CVE-2026-61887.json index f1ffe02b6d..e0cceb90fa 100644 --- a/data/2026/CVE-2026-61887.json +++ b/data/2026/CVE-2026-61887.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing critical step in authentication in the MigTD SPDM rebind implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. Network adversary with an unauthenticated user combined with a low complexity attack may enable remote code execution. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-61887","lastModified":"2026-11-10T18:17:44.703","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:44.703","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-304"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing critical step in authentication in the MigTD SPDM rebind implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. Network adversary with an unauthenticated user combined with a low complexity attack may enable remote code execution. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-61887","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:44.703","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-304"}],"source":"secure@intel.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-61900.json b/data/2026/CVE-2026-61900.json index e7133a4b43..876819912d 100644 --- a/data/2026/CVE-2026-61900.json +++ b/data/2026/CVE-2026-61900.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"dj-extensions.com","versions":[{"status":"affected","version":"4.1.0-4.1.5"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE."},{"lang":"es","value":"Extensión de Joomla - dj-extensions.com - Carga de archivos arbitraria no autenticada en DJ-jDownloads anterior a 4.1.6 - La extensión de Joomla JDownloads es vulnerable a una carga de archivos no autenticada, lo que lleva a una RCE completa."}],"id":"CVE-2026-61900","lastModified":"2026-10-24T20:10:00.137","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61900","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-07-21T16:37:02.259542Z","version":"2.0.3"}}]},"published":"2026-07-20T19:17:28.267","references":[{"source":"security@joomla.org","url":"https://mysites.guru/blog/jdownloads-4-1-unauthenticated-upload-flaw/"},{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@joomla.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"4.1.0-4.1.5"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - Unauthenticated arbitrary file upload in jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE."},{"lang":"es","value":"Extensión de Joomla - dj-extensions.com - Carga de archivos arbitraria no autenticada en DJ-jDownloads anterior a 4.1.6 - La extensión de Joomla JDownloads es vulnerable a una carga de archivos no autenticada, lo que lleva a una RCE completa."}],"id":"CVE-2026-61900","lastModified":"2026-11-12T18:17:50.900","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61900","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-07-21T16:37:02.259542Z","version":"2.0.3"}}]},"published":"2026-07-20T19:17:28.267","references":[{"source":"security@joomla.org","url":"https://mysites.guru/blog/jdownloads-4-1-unauthenticated-upload-flaw/"},{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-62107.json b/data/2026/CVE-2026-62107.json index f6d56ba356..8f2131daa1 100644 --- a/data/2026/CVE-2026-62107.json +++ b/data/2026/CVE-2026-62107.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"learning-management-system","product":"Masteriyo - LMS","vendor":"masteriyo","versions":[{"changes":[{"at":"3.4.1","status":"unaffected"}],"lessThanOrEqual":"3.4.0","status":"affected","version":"n/a","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions."}],"id":"CVE-2026-62107","lastModified":"2026-09-11T21:17:12.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-62107","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-11T20:09:23.064752Z","version":"2.0.3"}}]},"published":"2026-09-11T19:17:43.583","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-3-4-0-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"learning-management-system","product":"Masteriyo - LMS","vendor":"ThemeGrill","versions":[{"changes":[{"at":"3.4.1","status":"unaffected"}],"lessThanOrEqual":"3.4.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Object Injection.This issue affects Masteriyo - LMS: from n/a through 3.4.0."}],"id":"CVE-2026-62107","lastModified":"2026-11-12T17:17:45.757","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-62107","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-11T20:09:23.064752Z","version":"2.0.3"}}]},"published":"2026-09-11T19:17:43.583","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-3-4-0-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-62275.json b/data/2026/CVE-2026-62275.json index a8485cc05f..22b1f05f6e 100644 --- a/data/2026/CVE-2026-62275.json +++ b/data/2026/CVE-2026-62275.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Detection of error condition without action in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62275","lastModified":"2026-11-10T18:17:44.860","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:44.860","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-390"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Detection of error condition without action in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62275","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:44.860","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-390"}],"source":"secure@intel.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-62303.json b/data/2026/CVE-2026-62303.json index 1aa6088269..a766c5f495 100644 --- a/data/2026/CVE-2026-62303.json +++ b/data/2026/CVE-2026-62303.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"pistache","vendor":"pistacheio","versions":[{"status":"affected","version":">= 0.0.5, <= 0.4.26"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication."}],"id":"CVE-2026-62303","lastModified":"2026-10-30T19:39:14.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-10-30T19:18:33.217","references":[{"source":"security-advisories@github.com","url":"https://github.com/pistacheio/pistache/commit/935461352403696f3ca0dbb9a7de7d2609e7ce91"},{"source":"security-advisories@github.com","url":"https://github.com/pistacheio/pistache/security/advisories/GHSA-q474-pqcp-gqm5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-674"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"pistache","vendor":"pistacheio","versions":[{"status":"affected","version":">= 0.0.5, <= 0.4.26"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication."}],"id":"CVE-2026-62303","lastModified":"2026-11-12T20:18:49.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-62303","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:31:55.752014Z","version":"2.0.3"}}]},"published":"2026-10-30T19:18:33.217","references":[{"source":"security-advisories@github.com","url":"https://github.com/pistacheio/pistache/commit/935461352403696f3ca0dbb9a7de7d2609e7ce91"},{"source":"security-advisories@github.com","url":"https://github.com/pistacheio/pistache/security/advisories/GHSA-q474-pqcp-gqm5"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/pistacheio/pistache/security/advisories/GHSA-q474-pqcp-gqm5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-674"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-62855.json b/data/2026/CVE-2026-62855.json index 74bc9f7d0c..91a45575bc 100644 --- a/data/2026/CVE-2026-62855.json +++ b/data/2026/CVE-2026-62855.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"freescout","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.225"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrator who also knows the APP_KEY can supply traversal segments that the filesystem normalizes outside storage/logs. The /app-logs/app route can then read local files accessible to the PHP worker, including environment files, source files, credentials, tokens, and operating-system files. This issue is fixed in version 1.8.225."}],"id":"CVE-2026-62855","lastModified":"2026-11-06T18:18:17.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-62855","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:45:55.570543Z","version":"2.0.3"}}]},"published":"2026-11-06T17:18:33.877","references":[{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/commit/2cd2e66b772ea9f9513cac6e82f9381bac9993c3"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9ph7-f3hc-95gg"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9ph7-f3hc-95gg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"freescout","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.225"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrator who also knows the APP_KEY can supply traversal segments that the filesystem normalizes outside storage/logs. The /app-logs/app route can then read local files accessible to the PHP worker, including environment files, source files, credentials, tokens, and operating-system files. This issue is fixed in version 1.8.225."}],"id":"CVE-2026-62855","lastModified":"2026-11-12T19:13:56.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-62855","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:45:55.570543Z","version":"2.0.3"}}]},"published":"2026-11-06T17:18:33.877","references":[{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/commit/2cd2e66b772ea9f9513cac6e82f9381bac9993c3"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225"},{"source":"security-advisories@github.com","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9ph7-f3hc-95gg"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9ph7-f3hc-95gg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-62920.json b/data/2026/CVE-2026-62920.json index 757e03f2a2..8a9401f63a 100644 --- a/data/2026/CVE-2026-62920.json +++ b/data/2026/CVE-2026-62920.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unchecked return value in the MigTD error handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62920","lastModified":"2026-11-10T18:17:45.003","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.003","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unchecked return value in the MigTD error handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62920","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.003","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"secure@intel.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-62929.json b/data/2026/CVE-2026-62929.json index 1a1719ecbb..27d4884953 100644 --- a/data/2026/CVE-2026-62929.json +++ b/data/2026/CVE-2026-62929.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Expired pointer dereference in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62929","lastModified":"2026-11-10T18:17:45.130","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.130","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-825"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Expired pointer dereference in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62929","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.130","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-825"}],"source":"secure@intel.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-62930.json b/data/2026/CVE-2026-62930.json index 0dd14f8a29..c18ab0fffe 100644 --- a/data/2026/CVE-2026-62930.json +++ b/data/2026/CVE-2026-62930.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unchecked return value in the MigTD's TLS implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62930","lastModified":"2026-11-10T18:17:45.263","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.263","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unchecked return value in the MigTD's TLS implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62930","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.263","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-252"}],"source":"secure@intel.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63018.json b/data/2026/CVE-2026-63018.json index 003b416d27..e494e61653 100644 --- a/data/2026/CVE-2026-63018.json +++ b/data/2026/CVE-2026-63018.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Metrics Discovery Application Programming Interface software","vendor":"n/a","versions":[{"status":"affected","version":"before version 1.16.189"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer underflow (wrap or wraparound) for some Intel(R) Metrics Discovery Application Programming Interface software before version 1.16.189 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-63018","lastModified":"2026-11-10T18:17:45.390","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.390","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01565.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Metrics Discovery Application Programming Interface software","vendor":"n/a","versions":[{"status":"affected","version":"before version 1.16.189"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer underflow (wrap or wraparound) for some Intel(R) Metrics Discovery Application Programming Interface software before version 1.16.189 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-63018","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.390","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01565.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"secure@intel.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63027.json b/data/2026/CVE-2026-63027.json index a9c8765b8d..2a456ea51e 100644 --- a/data/2026/CVE-2026-63027.json +++ b/data/2026/CVE-2026-63027.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect behavior order in the get_tcb_level_by_svn for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-63027","lastModified":"2026-11-10T18:17:45.523","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.523","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect behavior order in the get_tcb_level_by_svn for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-63027","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.523","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"secure@intel.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63028.json b/data/2026/CVE-2026-63028.json index 94c45d9052..40fe47e27a 100644 --- a/data/2026/CVE-2026-63028.json +++ b/data/2026/CVE-2026-63028.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper initialization in the MigTD virtio-vsock stream handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. System software adversary with an unauthenticated user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-63028","lastModified":"2026-11-10T18:17:45.657","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.657","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-665"}],"source":"secure@intel.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper initialization in the MigTD virtio-vsock stream handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. System software adversary with an unauthenticated user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-63028","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}]},"published":"2026-11-10T18:17:45.657","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-665"}],"source":"secure@intel.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63183.json b/data/2026/CVE-2026-63183.json index 360ec36a5e..df2d68c737 100644 --- a/data/2026/CVE-2026-63183.json +++ b/data/2026/CVE-2026-63183.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"omniauth","vendor":"omniauth","versions":[{"status":"affected","version":"< 2.2.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0."}],"id":"CVE-2026-63183","lastModified":"2026-11-05T20:17:59.357","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:19:56.610534Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:40.650","references":[{"source":"security-advisories@github.com","url":"https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90"},{"source":"security-advisories@github.com","url":"https://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"omniauth","vendor":"omniauth","versions":[{"status":"affected","version":"< 2.2.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0."}],"id":"CVE-2026-63183","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:19:56.610534Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:40.650","references":[{"source":"security-advisories@github.com","url":"https://github.com/omniauth/omniauth/commit/943b44faea242f063fa9230254fe7d60cfcc9c90"},{"source":"security-advisories@github.com","url":"https://github.com/omniauth/omniauth/security/advisories/GHSA-m27g-v28p-f9fx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63194.json b/data/2026/CVE-2026-63194.json index 46bcf0c55f..7cced9eb8b 100644 --- a/data/2026/CVE-2026-63194.json +++ b/data/2026/CVE-2026-63194.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"bahmni-core","vendor":"Bahmni","versions":[{"status":"affected","version":"= 0.93"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1."}],"id":"CVE-2026-63194","lastModified":"2026-11-11T03:16:52.200","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T03:16:52.200","references":[{"source":"security-advisories@github.com","url":"https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-pmw7-2mfv-4592"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"bahmni-core","vendor":"Bahmni","versions":[{"status":"affected","version":"= 0.93"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1."}],"id":"CVE-2026-63194","lastModified":"2026-11-12T18:17:51.057","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63194","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:55.686238Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:52.200","references":[{"source":"security-advisories@github.com","url":"https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-pmw7-2mfv-4592"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63282.json b/data/2026/CVE-2026-63282.json index 3ef39539c4..f497020bca 100644 --- a/data/2026/CVE-2026-63282.json +++ b/data/2026/CVE-2026-63282.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"13.0.84","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"12.11.123","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"11.11.231","status":"affected","version":"11.0.0","versionType":"semver"},{"lessThan":"10.12.354","status":"affected","version":"10.0.0","versionType":"semver"},{"lessThan":"9.80.153","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThan":"8.40.112","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"6.50.5.23","status":"affected","version":"6.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation."}],"id":"CVE-2026-63282","lastModified":"2026-11-10T06:17:09.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:09.887","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/c5/06/79/cve-2026-63282pdf-en-US-561259.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"13.0.84","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"12.11.123","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"11.11.231","status":"affected","version":"11.0.0","versionType":"semver"},{"lessThan":"10.12.354","status":"affected","version":"10.0.0","versionType":"semver"},{"lessThan":"9.80.153","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThan":"8.40.112","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"6.50.5.23","status":"affected","version":"6.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation."}],"id":"CVE-2026-63282","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63282","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:12:39.343908Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:09.887","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/c5/06/79/cve-2026-63282pdf-en-US-561259.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63287.json b/data/2026/CVE-2026-63287.json index 0245240bd7..5fd3b1d9d0 100644 --- a/data/2026/CVE-2026-63287.json +++ b/data/2026/CVE-2026-63287.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"AXIS Camera Station 5","vendor":"Axis Communications AB","versions":[{"lessThan":"5.59","status":"affected","version":"5.0","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station."}],"id":"CVE-2026-63287","lastModified":"2026-11-10T06:17:10.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:10.043","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/bc/65/61/cve-2026-63287pdf-en-US-561253.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"},{"lang":"en","value":"CWE-863"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"AXIS Camera Station 5","vendor":"Axis Communications AB","versions":[{"lessThan":"5.59","status":"affected","version":"5.0","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station."}],"id":"CVE-2026-63287","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63287","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:41:25.707499Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:10.043","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/bc/65/61/cve-2026-63287pdf-en-US-561253.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"},{"lang":"en","value":"CWE-863"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63288.json b/data/2026/CVE-2026-63288.json index daa5f3617e..c885c06b74 100644 --- a/data/2026/CVE-2026-63288.json +++ b/data/2026/CVE-2026-63288.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS A1210 - Secure Entry","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"11.7.12.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1601 - Secure Entry","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"11.1.10.1","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1610 - Secure Entry","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"11.4.32.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1710","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"12.0.101.4","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1810 - Secure Entry","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"12.0.101.4","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer."}],"id":"CVE-2026-63288","lastModified":"2026-11-10T06:17:10.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:10.197","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/fa/79/f5/cve-2026-63288pdf-en-US-561260.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS A1210 - Secure Entry","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"11.7.12.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1601 - Secure Entry","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"11.1.10.1","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1610 - Secure Entry","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"11.4.32.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1710","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"12.0.101.4","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"AXIS A1810 - Secure Entry","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.106.1","status":"affected","version":"12.0.101.4","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer."}],"id":"CVE-2026-63288","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:13:39.276728Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:10.197","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/fa/79/f5/cve-2026-63288pdf-en-US-561260.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63417.json b/data/2026/CVE-2026-63417.json index 4df08d9988..f3c6f80d5d 100644 --- a/data/2026/CVE-2026-63417.json +++ b/data/2026/CVE-2026-63417.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"loggingredactor","vendor":"armurox","versions":[{"status":"affected","version":"< 0.0.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7."}],"id":"CVE-2026-63417","lastModified":"2026-11-09T16:17:33.947","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63417","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:33:32.164088Z","version":"2.0.3"}}]},"published":"2026-11-03T19:18:09.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/armurox/loggingredactor/commit/361a528e56437b9c269e69f3863de4b3e568391b"},{"source":"security-advisories@github.com","url":"https://github.com/armurox/loggingredactor/issues/12"},{"source":"security-advisories@github.com","url":"https://github.com/armurox/loggingredactor/pull/15"},{"source":"security-advisories@github.com","url":"https://github.com/armurox/loggingredactor/releases/tag/0.0.7"},{"source":"security-advisories@github.com","url":"https://github.com/armurox/loggingredactor/security/advisories/GHSA-w7qv-268h-9h3f"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/armurox/loggingredactor/issues/12"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"loggingredactor","vendor":"armurox","versions":[{"status":"affected","version":"< 0.0.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7."}],"id":"CVE-2026-63417","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63417","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:33:32.164088Z","version":"2.0.3"}}]},"published":"2026-11-03T19:18:09.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/armurox/loggingredactor/commit/361a528e56437b9c269e69f3863de4b3e568391b"},{"source":"security-advisories@github.com","url":"https://github.com/armurox/loggingredactor/issues/12"},{"source":"security-advisories@github.com","url":"https://github.com/armurox/loggingredactor/pull/15"},{"source":"security-advisories@github.com","url":"https://github.com/armurox/loggingredactor/releases/tag/0.0.7"},{"source":"security-advisories@github.com","url":"https://github.com/armurox/loggingredactor/security/advisories/GHSA-w7qv-268h-9h3f"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/armurox/loggingredactor/issues/12"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63418.json b/data/2026/CVE-2026-63418.json index d9143a2586..314f603de5 100644 --- a/data/2026/CVE-2026-63418.json +++ b/data/2026/CVE-2026-63418.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"monitoring-plugins","vendor":"monitoring-plugins","versions":[{"status":"affected","version":">= 3.0.0-rc1, < 3.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1."}],"id":"CVE-2026-63418","lastModified":"2026-11-03T23:17:51.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63418","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T22:36:36.088082Z","version":"2.0.3"}}]},"published":"2026-11-03T18:18:03.533","references":[{"source":"security-advisories@github.com","url":"https://github.com/monitoring-plugins/monitoring-plugins/commit/c35c12e58d326ffbd6cfb3c9097653f9f3fb2f4a"},{"source":"security-advisories@github.com","url":"https://github.com/monitoring-plugins/monitoring-plugins/releases/tag/v3.0.1"},{"source":"security-advisories@github.com","url":"https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-xvvw-4j77-rp7q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"monitoring-plugins","vendor":"monitoring-plugins","versions":[{"status":"affected","version":">= 3.0.0-rc1, < 3.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1."}],"id":"CVE-2026-63418","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63418","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T22:36:36.088082Z","version":"2.0.3"}}]},"published":"2026-11-03T18:18:03.533","references":[{"source":"security-advisories@github.com","url":"https://github.com/monitoring-plugins/monitoring-plugins/commit/c35c12e58d326ffbd6cfb3c9097653f9f3fb2f4a"},{"source":"security-advisories@github.com","url":"https://github.com/monitoring-plugins/monitoring-plugins/releases/tag/v3.0.1"},{"source":"security-advisories@github.com","url":"https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-xvvw-4j77-rp7q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63436.json b/data/2026/CVE-2026-63436.json index 89f7c01295..25001c6873 100644 --- a/data/2026/CVE-2026-63436.json +++ b/data/2026/CVE-2026-63436.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"zt-zip","vendor":"zeroturnaround","versions":[{"status":"affected","version":"< 1.18.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0."}],"id":"CVE-2026-63436","lastModified":"2026-11-09T16:17:34.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63436","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:30:44.506719Z","version":"2.0.3"}}]},"published":"2026-11-03T18:18:03.727","references":[{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/pull/180"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"zt-zip","vendor":"zeroturnaround","versions":[{"status":"affected","version":"< 1.18.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0."}],"id":"CVE-2026-63436","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63436","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:30:44.506719Z","version":"2.0.3"}}]},"published":"2026-11-03T18:18:03.727","references":[{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/pull/180"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63499.json b/data/2026/CVE-2026-63499.json index 8ddfd32c0d..b82b5201db 100644 --- a/data/2026/CVE-2026-63499.json +++ b/data/2026/CVE-2026-63499.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"zt-zip","vendor":"zeroturnaround","versions":[{"status":"affected","version":"< 1.18.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1."}],"id":"CVE-2026-63499","lastModified":"2026-11-03T20:18:16.777","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63499","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T19:38:07.051046Z","version":"2.0.3"}}]},"published":"2026-11-03T18:18:04.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/pull/191"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"zt-zip","vendor":"zeroturnaround","versions":[{"status":"affected","version":"< 1.18.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1."}],"id":"CVE-2026-63499","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63499","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T19:38:07.051046Z","version":"2.0.3"}}]},"published":"2026-11-03T18:18:04.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/pull/191"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1"},{"source":"security-advisories@github.com","url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63634.json b/data/2026/CVE-2026-63634.json index aa5a71c6e2..3f01ca824f 100644 --- a/data/2026/CVE-2026-63634.json +++ b/data/2026/CVE-2026-63634.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"pympp","vendor":"tempoxyz","versions":[{"status":"affected","version":"< 0.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the fee_payer, pympp validates calldata using eth_abi decoding, which is lenient about trailing bytes. The FeePayerPolicy caps gas_limit (≤ 2 M) and max_fee_per_gas (≤ 100 Gwei) but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 gas per non-zero byte. Appending N bytes of 0x01 padding inflates actual gas used by N × 16 while keeping gas_limit and max_fee_per_gas within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet. This issue has been patched in version 0.9.1."}],"id":"CVE-2026-63634","lastModified":"2026-11-09T22:18:53.803","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:53.803","references":[{"source":"security-advisories@github.com","url":"https://github.com/tempoxyz/pympp/commit/57a750d0d980b8e6c3bea62a40b7621f176ff1f0"},{"source":"security-advisories@github.com","url":"https://github.com/tempoxyz/pympp/releases/tag/v0.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/tempoxyz/pympp/security/advisories/GHSA-v858-xh7w-8jr5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"pympp","vendor":"tempoxyz","versions":[{"status":"affected","version":"< 0.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the fee_payer, pympp validates calldata using eth_abi decoding, which is lenient about trailing bytes. The FeePayerPolicy caps gas_limit (≤ 2 M) and max_fee_per_gas (≤ 100 Gwei) but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 gas per non-zero byte. Appending N bytes of 0x01 padding inflates actual gas used by N × 16 while keeping gas_limit and max_fee_per_gas within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet. This issue has been patched in version 0.9.1."}],"id":"CVE-2026-63634","lastModified":"2026-11-12T19:17:05.617","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63634","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:29.192174Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:53.803","references":[{"source":"security-advisories@github.com","url":"https://github.com/tempoxyz/pympp/commit/57a750d0d980b8e6c3bea62a40b7621f176ff1f0"},{"source":"security-advisories@github.com","url":"https://github.com/tempoxyz/pympp/releases/tag/v0.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/tempoxyz/pympp/security/advisories/GHSA-v858-xh7w-8jr5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63651.json b/data/2026/CVE-2026-63651.json index d53e154cc0..dab661a5d2 100644 --- a/data/2026/CVE-2026-63651.json +++ b/data/2026/CVE-2026-63651.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"livedocs","vendor":"PsychQuant","versions":[{"status":"affected","version":"< 0.7.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect (kinds openapi/graphql, and resolve_source's docs_url) pass a client-supplied URL straight to URLSession with no scheme or host allowlist, and redirects are followed unconditionally. A prompt-injection payload embedded in fetched documentation can steer the model to call fetch_docs against internal or metadata endpoints and stream the response back into the conversation. This issue has been patched in version 0.7.0."}],"id":"CVE-2026-63651","lastModified":"2026-11-10T17:17:46.143","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T17:17:46.143","references":[{"source":"security-advisories@github.com","url":"https://github.com/PsychQuant/livedocs/releases/tag/v0.7.0"},{"source":"security-advisories@github.com","url":"https://github.com/PsychQuant/livedocs/security/advisories/GHSA-xf4p-x7v8-3x4p"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"livedocs","vendor":"PsychQuant","versions":[{"status":"affected","version":"< 0.7.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect (kinds openapi/graphql, and resolve_source's docs_url) pass a client-supplied URL straight to URLSession with no scheme or host allowlist, and redirects are followed unconditionally. A prompt-injection payload embedded in fetched documentation can steer the model to call fetch_docs against internal or metadata endpoints and stream the response back into the conversation. This issue has been patched in version 0.7.0."}],"id":"CVE-2026-63651","lastModified":"2026-11-12T19:17:05.750","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63651","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:48.795098Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:46.143","references":[{"source":"security-advisories@github.com","url":"https://github.com/PsychQuant/livedocs/releases/tag/v0.7.0"},{"source":"security-advisories@github.com","url":"https://github.com/PsychQuant/livedocs/security/advisories/GHSA-xf4p-x7v8-3x4p"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63835.json b/data/2026/CVE-2026-63835.json index 7c39520b5d..21f70d5a0b 100644 --- a/data/2026/CVE-2026-63835.json +++ b/data/2026/CVE-2026-63835.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/bat_v.c","net/batman-adv/bat_v_ogm.c","net/batman-adv/types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d462ced79dd430200cf888984e8005da77fc810b","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"f79deaaf822ab0ee2424cf28781f9ab91576bea3","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"d3569327fc7395b2b0461a0a0cb77a0bb74786c0","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"97644fdaaf6446ffbe182c5eb804fceb5b1a51b7","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"f04dde74399431fb07abbdd9cd5d0ed624771d04","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"3d4548c96d6f21ac1a9b06c5f82f3ef439c87023","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"86ab6b6fb5b82163bf6c45780bb72150021d7349","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"d11c00b95b2a3b3934007fc003dccc6fdcc061ad","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/bat_v.c","net/batman-adv/bat_v_ogm.c","net/batman-adv/types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.260","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.211","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.95","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.38","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: v: prevent OGM aggregation on disabled hardif\n\nWhen an interface gets disabled, the worker is correctly disabled by\nbatadv_hardif_disable_interface() -> ... -> batadv_v_ogm_iface_disable().\nIn this process, the skb aggr_list is also freed.\n\nBut batadv_v_ogm_send_meshif() can still queue new skbs (via\nbatadv_v_ogm_queue_on_if()) to the aggr_list. This will only stop after all\ncores can no longer find the RCU protected list of hard interfaces. These\nqueued skbs will never be freed or consumed by batadv_v_ogm_aggr_work.\n\nThe batadv_v_ogm_iface_disable() function must block\nbatadv_v_ogm_queue_on_if() to avoid leak of skbs."}],"id":"CVE-2026-63835","lastModified":"2026-08-17T05:17:21.483","metrics":{},"published":"2026-07-19T12:16:56.970","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3d4548c96d6f21ac1a9b06c5f82f3ef439c87023"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/86ab6b6fb5b82163bf6c45780bb72150021d7349"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/97644fdaaf6446ffbe182c5eb804fceb5b1a51b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d11c00b95b2a3b3934007fc003dccc6fdcc061ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d3569327fc7395b2b0461a0a0cb77a0bb74786c0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d462ced79dd430200cf888984e8005da77fc810b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f04dde74399431fb07abbdd9cd5d0ed624771d04"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f79deaaf822ab0ee2424cf28781f9ab91576bea3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/bat_v.c","net/batman-adv/bat_v_ogm.c","net/batman-adv/types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d462ced79dd430200cf888984e8005da77fc810b","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"f79deaaf822ab0ee2424cf28781f9ab91576bea3","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"d3569327fc7395b2b0461a0a0cb77a0bb74786c0","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"97644fdaaf6446ffbe182c5eb804fceb5b1a51b7","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"f04dde74399431fb07abbdd9cd5d0ed624771d04","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"3d4548c96d6f21ac1a9b06c5f82f3ef439c87023","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"86ab6b6fb5b82163bf6c45780bb72150021d7349","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"},{"lessThan":"d11c00b95b2a3b3934007fc003dccc6fdcc061ad","status":"affected","version":"f89255a02f1d75d8e1b9d1c31435fcb64840cb2a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/bat_v.c","net/batman-adv/bat_v_ogm.c","net/batman-adv/types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.260","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.211","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.95","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.38","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C0AD3AD5-8CFC-43E1-BCEA-4DB1582A96FA","versionEndExcluding":"5.10.260","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D71C101E-388C-4A46-BD99-49049F7C5CFF","versionEndExcluding":"5.15.211","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"333C9E30-7FD4-46A2-94EF-C1AA1F3EE28B","versionEndExcluding":"6.1.177","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C8AD3BC8-C843-423C-B9DB-CB52F67F578E","versionEndExcluding":"6.6.144","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4E206B86-E0E3-4394-A93F-39F2D50A8AA8","versionEndExcluding":"6.12.95","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA591B28-5D62-449E-BDBE-3C9391BF070A","versionEndExcluding":"6.18.38","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E","versionEndExcluding":"7.1.3","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: v: prevent OGM aggregation on disabled hardif\n\nWhen an interface gets disabled, the worker is correctly disabled by\nbatadv_hardif_disable_interface() -> ... -> batadv_v_ogm_iface_disable().\nIn this process, the skb aggr_list is also freed.\n\nBut batadv_v_ogm_send_meshif() can still queue new skbs (via\nbatadv_v_ogm_queue_on_if()) to the aggr_list. This will only stop after all\ncores can no longer find the RCU protected list of hard interfaces. These\nqueued skbs will never be freed or consumed by batadv_v_ogm_aggr_work.\n\nThe batadv_v_ogm_iface_disable() function must block\nbatadv_v_ogm_queue_on_if() to avoid leak of skbs."}],"id":"CVE-2026-63835","lastModified":"2026-11-12T19:50:03.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-19T12:16:56.970","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d4548c96d6f21ac1a9b06c5f82f3ef439c87023"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86ab6b6fb5b82163bf6c45780bb72150021d7349"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/97644fdaaf6446ffbe182c5eb804fceb5b1a51b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d11c00b95b2a3b3934007fc003dccc6fdcc061ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3569327fc7395b2b0461a0a0cb77a0bb74786c0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d462ced79dd430200cf888984e8005da77fc810b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f04dde74399431fb07abbdd9cd5d0ed624771d04"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f79deaaf822ab0ee2424cf28781f9ab91576bea3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63836.json b/data/2026/CVE-2026-63836.json index 100dcc930c..219402ec32 100644 --- a/data/2026/CVE-2026-63836.json +++ b/data/2026/CVE-2026-63836.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/tp_meter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"35264c4d46067d6312871488c810cef387f8c1f6","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"1381b021bf886b793fa5ffb895a8efae7ba0318f","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"d08b69da40a101df1e28bfe1e8fa7a09ffa41107","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"cd74176cf1685f35a2e5f212d15748bbfecb53b6","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"ac229c86e49fdb96d91f51bc2fa37a9c4f58c44f","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"7d2a44bc6bbe39aed03c68864aa0e54e04a50278","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"585616dab0aa9c45bc11b2c8082ca78533bc00e9","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"33ccd52f3cc9ed46ce395199f89aa3234dc83314","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/tp_meter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.8"},{"lessThan":"4.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.260","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.211","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.95","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.38","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: avoid divide-by-zero for dec_cwnd\n\nThe cwnd is always MSS <= cwnd <= 0x20000000. But the calculation in\nbatadv_tp_update_cwnd() assumes unsigned 32 bit arithmetics.\n\n ((mss * 8) ** 2) / (cwnd * 8)\n\nIn case cwnd is actually 0x20000000, it will be shifted by 3 bit to the\nleft end up at 0x100000000 or U32_MAX + 1. It will therefore wrap around\nand be 0 - resulting in:\n\n ((mss * 8) ** 2) / 0\n\nThis is of course invalid and cannot be calculated. The calculation should\nmust be simplified to avoid this overflow:\n\n (mss ** 2) * 8 / cwnd\n\nIt will keep the precision enhancement from the scaling (by 8) but avoid\nthe overflow in the divisor.\n\nIn theory, there could still be an overflow in the dividend. It is at the\nmoment fixed to BATADV_TP_PLEN in batadv_tp_recv_ack() - so it is not an\nimminent problem. But allowing it to use the whole u32 bit range, would\nmean that it can still use up to 67 bits. To keep this calculation safe for\n32 bit arithmetic, mss must never use more than floor((32 - 3) / 2) bits -\nor in other words: must never be larger than 16383."}],"id":"CVE-2026-63836","lastModified":"2026-08-17T05:17:21.600","metrics":{},"published":"2026-07-19T12:16:57.103","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1381b021bf886b793fa5ffb895a8efae7ba0318f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/33ccd52f3cc9ed46ce395199f89aa3234dc83314"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/35264c4d46067d6312871488c810cef387f8c1f6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/585616dab0aa9c45bc11b2c8082ca78533bc00e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7d2a44bc6bbe39aed03c68864aa0e54e04a50278"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ac229c86e49fdb96d91f51bc2fa37a9c4f58c44f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cd74176cf1685f35a2e5f212d15748bbfecb53b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d08b69da40a101df1e28bfe1e8fa7a09ffa41107"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/tp_meter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"35264c4d46067d6312871488c810cef387f8c1f6","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"1381b021bf886b793fa5ffb895a8efae7ba0318f","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"d08b69da40a101df1e28bfe1e8fa7a09ffa41107","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"cd74176cf1685f35a2e5f212d15748bbfecb53b6","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"ac229c86e49fdb96d91f51bc2fa37a9c4f58c44f","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"7d2a44bc6bbe39aed03c68864aa0e54e04a50278","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"585616dab0aa9c45bc11b2c8082ca78533bc00e9","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"},{"lessThan":"33ccd52f3cc9ed46ce395199f89aa3234dc83314","status":"affected","version":"33a3bb4a3345bb511f9c69c913da95d4693e2a4e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/tp_meter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.8"},{"lessThan":"4.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.260","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.211","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.95","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.38","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AA15F865-60B0-418F-BEDA-94119897624C","versionEndExcluding":"5.10.260","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D71C101E-388C-4A46-BD99-49049F7C5CFF","versionEndExcluding":"5.15.211","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"333C9E30-7FD4-46A2-94EF-C1AA1F3EE28B","versionEndExcluding":"6.1.177","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C8AD3BC8-C843-423C-B9DB-CB52F67F578E","versionEndExcluding":"6.6.144","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4E206B86-E0E3-4394-A93F-39F2D50A8AA8","versionEndExcluding":"6.12.95","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA591B28-5D62-449E-BDBE-3C9391BF070A","versionEndExcluding":"6.18.38","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E","versionEndExcluding":"7.1.3","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: avoid divide-by-zero for dec_cwnd\n\nThe cwnd is always MSS <= cwnd <= 0x20000000. But the calculation in\nbatadv_tp_update_cwnd() assumes unsigned 32 bit arithmetics.\n\n ((mss * 8) ** 2) / (cwnd * 8)\n\nIn case cwnd is actually 0x20000000, it will be shifted by 3 bit to the\nleft end up at 0x100000000 or U32_MAX + 1. It will therefore wrap around\nand be 0 - resulting in:\n\n ((mss * 8) ** 2) / 0\n\nThis is of course invalid and cannot be calculated. The calculation should\nmust be simplified to avoid this overflow:\n\n (mss ** 2) * 8 / cwnd\n\nIt will keep the precision enhancement from the scaling (by 8) but avoid\nthe overflow in the divisor.\n\nIn theory, there could still be an overflow in the dividend. It is at the\nmoment fixed to BATADV_TP_PLEN in batadv_tp_recv_ack() - so it is not an\nimminent problem. But allowing it to use the whole u32 bit range, would\nmean that it can still use up to 67 bits. To keep this calculation safe for\n32 bit arithmetic, mss must never use more than floor((32 - 3) / 2) bits -\nor in other words: must never be larger than 16383."}],"id":"CVE-2026-63836","lastModified":"2026-11-12T19:50:47.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-19T12:16:57.103","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1381b021bf886b793fa5ffb895a8efae7ba0318f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33ccd52f3cc9ed46ce395199f89aa3234dc83314"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/35264c4d46067d6312871488c810cef387f8c1f6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/585616dab0aa9c45bc11b2c8082ca78533bc00e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7d2a44bc6bbe39aed03c68864aa0e54e04a50278"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac229c86e49fdb96d91f51bc2fa37a9c4f58c44f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cd74176cf1685f35a2e5f212d15748bbfecb53b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d08b69da40a101df1e28bfe1e8fa7a09ffa41107"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63837.json b/data/2026/CVE-2026-63837.json index f28245e422..7754aa4de3 100644 --- a/data/2026/CVE-2026-63837.json +++ b/data/2026/CVE-2026-63837.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/amazon/ena/ena_phc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bddf59818ae5102e6d82a4dae5add6df8da38fb0","status":"affected","version":"e0ea34158ee8c4f7536cd781010339ff28c0d24c","versionType":"git"},{"lessThan":"edcb049d836e175e7b3d5e0d05657104545b5e65","status":"affected","version":"e0ea34158ee8c4f7536cd781010339ff28c0d24c","versionType":"git"},{"lessThan":"24a08d7d6218d60c033015cf4870b6096446e734","status":"affected","version":"e0ea34158ee8c4f7536cd781010339ff28c0d24c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/amazon/ena/ena_phc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.33","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: PHC: Check return code before setting timestamp output\n\nena_phc_gettimex64() is setting the output parameter regardless\nof whether ena_com_phc_get_timestamp() succeeded or failed.\n\nWhen ena_com_phc_get_timestamp() returns an error, the timestamp\nparameter may contain uninitialized stack memory (e.g., when PHC is\ndisabled or in blocked state) or invalid hardware values. Passing\nthese to userspace via the PTP ioctl is both a security issue\n(information leak) and a correctness bug.\n\nFix by checking the return code after releasing the lock and only\nsetting the output timestamp on success."}],"id":"CVE-2026-63837","lastModified":"2026-07-27T17:44:23.777","metrics":{},"published":"2026-07-19T15:16:50.480","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/24a08d7d6218d60c033015cf4870b6096446e734"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bddf59818ae5102e6d82a4dae5add6df8da38fb0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/edcb049d836e175e7b3d5e0d05657104545b5e65"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/amazon/ena/ena_phc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bddf59818ae5102e6d82a4dae5add6df8da38fb0","status":"affected","version":"e0ea34158ee8c4f7536cd781010339ff28c0d24c","versionType":"git"},{"lessThan":"edcb049d836e175e7b3d5e0d05657104545b5e65","status":"affected","version":"e0ea34158ee8c4f7536cd781010339ff28c0d24c","versionType":"git"},{"lessThan":"24a08d7d6218d60c033015cf4870b6096446e734","status":"affected","version":"e0ea34158ee8c4f7536cd781010339ff28c0d24c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/amazon/ena/ena_phc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.33","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4F0E1027-1081-4E2B-9D56-AF79BAFF146B","versionEndExcluding":"6.18.33","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A13475D2-59BF-4716-94B5-7C1D239A2CF4","versionEndExcluding":"7.0.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: PHC: Check return code before setting timestamp output\n\nena_phc_gettimex64() is setting the output parameter regardless\nof whether ena_com_phc_get_timestamp() succeeded or failed.\n\nWhen ena_com_phc_get_timestamp() returns an error, the timestamp\nparameter may contain uninitialized stack memory (e.g., when PHC is\ndisabled or in blocked state) or invalid hardware values. Passing\nthese to userspace via the PTP ioctl is both a security issue\n(information leak) and a correctness bug.\n\nFix by checking the return code after releasing the lock and only\nsetting the output timestamp on success."}],"id":"CVE-2026-63837","lastModified":"2026-11-12T19:59:30.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-19T15:16:50.480","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/24a08d7d6218d60c033015cf4870b6096446e734"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bddf59818ae5102e6d82a4dae5add6df8da38fb0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edcb049d836e175e7b3d5e0d05657104545b5e65"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63883.json b/data/2026/CVE-2026-63883.json index 1a3c1f0693..3e8bb4c070 100644 --- a/data/2026/CVE-2026-63883.json +++ b/data/2026/CVE-2026-63883.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/serial/qcom_geni_serial.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c91ea13375f70f6271a0183445e34e83b8f4d8f7","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"b1159dce10b38eb795e4c96cdc4d34b83cec81c5","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"654f45a8569f3cd6ff20bd724a18e0cce65893ba","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"0d2c41a8b00934ddf8a7c1b4cf72dffa1e629c46","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"452d6fa37ae9b021f4f6d397dbae077f7296f6f4","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/tty/serial/qcom_geni_serial.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.3"},{"lessThan":"6.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ\n\nWhen uart_flush_buffer() runs before the DMA completion IRQ is delivered,\nthe following race can occur (all steps serialized by uart_port_lock):\n\n 1. DMA starts: tx_remaining = N, kfifo contains N bytes\n 2. DMA completes in hardware; IRQ is pending but not yet delivered\n 3. uart_flush_buffer() acquires the port lock and calls kfifo_reset(),\n making kfifo_len() = 0 while tx_remaining remains N\n 4. uart_flush_buffer() releases the port lock\n 5. DMA IRQ fires; handle_tx_dma() acquires the port lock and calls\n uart_xmit_advance(uport, tx_remaining) on an empty kfifo\n\nuart_xmit_advance() increments kfifo->out by tx_remaining. Since\nkfifo_reset() already set both in and out to 0, out wraps past in,\ncausing kfifo_len() to return UART_XMIT_SIZE - tx_remaining. The next\nstart_tx_dma() call then submits a DMA transfer of stale buffer data.\n\nFix this by snapshotting kfifo_len() at the start of handle_tx_dma()\nand skipping uart_xmit_advance() when fifo_len < tx_remaining, which\nindicates the kfifo was reset by a preceding flush."}],"id":"CVE-2026-63883","lastModified":"2026-07-27T17:44:23.777","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.5,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-07-19T16:17:05.343","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0d2c41a8b00934ddf8a7c1b4cf72dffa1e629c46"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/452d6fa37ae9b021f4f6d397dbae077f7296f6f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/654f45a8569f3cd6ff20bd724a18e0cce65893ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b1159dce10b38eb795e4c96cdc4d34b83cec81c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c91ea13375f70f6271a0183445e34e83b8f4d8f7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/serial/qcom_geni_serial.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c91ea13375f70f6271a0183445e34e83b8f4d8f7","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"b1159dce10b38eb795e4c96cdc4d34b83cec81c5","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"654f45a8569f3cd6ff20bd724a18e0cce65893ba","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"0d2c41a8b00934ddf8a7c1b4cf72dffa1e629c46","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"452d6fa37ae9b021f4f6d397dbae077f7296f6f4","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/tty/serial/qcom_geni_serial.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.3"},{"lessThan":"6.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"40AC3123-FD85-4602-A174-1E62052982CC","versionEndExcluding":"6.6.143","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1E73413E-0629-41AA-A4D3-5A3D10A0BD63","versionEndExcluding":"6.12.93","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0FCCB23A-7629-4386-93B6-B119237C4382","versionEndExcluding":"6.18.35","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9161A938-0FA8-44BC-95FE-C5A271601AB3","versionEndExcluding":"7.0.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","matchCriteriaId":"E5910A9D-F60A-409A-B486-FE66BFEBA9B9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*","matchCriteriaId":"81DFF19E-9CF8-49C6-8C36-1E4038622933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ\n\nWhen uart_flush_buffer() runs before the DMA completion IRQ is delivered,\nthe following race can occur (all steps serialized by uart_port_lock):\n\n 1. DMA starts: tx_remaining = N, kfifo contains N bytes\n 2. DMA completes in hardware; IRQ is pending but not yet delivered\n 3. uart_flush_buffer() acquires the port lock and calls kfifo_reset(),\n making kfifo_len() = 0 while tx_remaining remains N\n 4. uart_flush_buffer() releases the port lock\n 5. DMA IRQ fires; handle_tx_dma() acquires the port lock and calls\n uart_xmit_advance(uport, tx_remaining) on an empty kfifo\n\nuart_xmit_advance() increments kfifo->out by tx_remaining. Since\nkfifo_reset() already set both in and out to 0, out wraps past in,\ncausing kfifo_len() to return UART_XMIT_SIZE - tx_remaining. The next\nstart_tx_dma() call then submits a DMA transfer of stale buffer data.\n\nFix this by snapshotting kfifo_len() at the start of handle_tx_dma()\nand skipping uart_xmit_advance() when fifo_len < tx_remaining, which\nindicates the kfifo was reset by a preceding flush."}],"id":"CVE-2026-63883","lastModified":"2026-11-12T20:00:16.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.5,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-07-19T16:17:05.343","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d2c41a8b00934ddf8a7c1b4cf72dffa1e629c46"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/452d6fa37ae9b021f4f6d397dbae077f7296f6f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/654f45a8569f3cd6ff20bd724a18e0cce65893ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b1159dce10b38eb795e4c96cdc4d34b83cec81c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c91ea13375f70f6271a0183445e34e83b8f4d8f7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63890.json b/data/2026/CVE-2026-63890.json index cc46072b2f..307562f410 100644 --- a/data/2026/CVE-2026-63890.json +++ b/data/2026/CVE-2026-63890.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/scsi/fcoe/fcoe_ctlr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d179949d2175d2857d1c3a275a22bea58bcc5d36","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"fda976f7390bb5d1e9b84ef11ebb17323038e0c6","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"80a0cd307205236ca28aa49bc553f58edcb9bf3a","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"549859a1131052b07dff11a448e9f3221a40f260","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"14dd80a20a72ce334adcc2d67402360527065948","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"d537d29d51c8b808469e5adacf3e5a0092700738","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"9eed1bd59937e6828b00d2f2dfef631d964f3636","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/scsi/fcoe/fcoe_ctlr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.30"},{"lessThan":"2.6.30","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker\n\ndrivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the\ndescriptor cursor by an attacker-supplied fip_dlen without ever\nrequiring dlen >= sizeof(struct fip_desc) in the default branch. The\nnamed descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked\ntheir per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor\n(fip_dtype >= 128, which the standard requires receivers to silently\nignore) skipped that check entirely.\n\nAn unauthenticated L2 peer on the FCoE control VLAN could hang\nfcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely\nby emitting one FIP CVL frame whose single descriptor had fip_dtype ==\nFIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes\nper iteration and the loop condition rlen >= sizeof(*desc) stayed true\nforever, blocking every subsequent FIP frame on that controller.\n\nTighten the outer dlen guard to also reject dlen < sizeof(struct\nfip_desc), so a malformed descriptor whose length cannot even cover the\ndescriptor header is rejected before the switch. This is the same\nlower-bound the named cases already apply and is the minimum scope that\ncloses the loop."}],"id":"CVE-2026-63890","lastModified":"2026-07-27T17:44:23.777","metrics":{},"published":"2026-07-19T16:17:06.300","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/14dd80a20a72ce334adcc2d67402360527065948"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/549859a1131052b07dff11a448e9f3221a40f260"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/80a0cd307205236ca28aa49bc553f58edcb9bf3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9eed1bd59937e6828b00d2f2dfef631d964f3636"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d179949d2175d2857d1c3a275a22bea58bcc5d36"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d537d29d51c8b808469e5adacf3e5a0092700738"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fda976f7390bb5d1e9b84ef11ebb17323038e0c6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/scsi/fcoe/fcoe_ctlr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d179949d2175d2857d1c3a275a22bea58bcc5d36","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"fda976f7390bb5d1e9b84ef11ebb17323038e0c6","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"80a0cd307205236ca28aa49bc553f58edcb9bf3a","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"549859a1131052b07dff11a448e9f3221a40f260","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"14dd80a20a72ce334adcc2d67402360527065948","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"d537d29d51c8b808469e5adacf3e5a0092700738","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"},{"lessThan":"9eed1bd59937e6828b00d2f2dfef631d964f3636","status":"affected","version":"97c8389d54b9665c38105ea72a428a44b97ff2f6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/scsi/fcoe/fcoe_ctlr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.30"},{"lessThan":"2.6.30","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CAAD4ACB-DF31-4BFD-8232-332A9957C39E","versionEndExcluding":"5.10.259","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5E938CDF-D1C4-43D0-98DC-9E11B6B55801","versionEndExcluding":"5.15.210","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C4446623-5F2B-4DD8-8666-9FAAC285A757","versionEndExcluding":"6.1.176","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C","versionEndExcluding":"6.6.143","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1E73413E-0629-41AA-A4D3-5A3D10A0BD63","versionEndExcluding":"6.12.93","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0FCCB23A-7629-4386-93B6-B119237C4382","versionEndExcluding":"6.18.35","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9161A938-0FA8-44BC-95FE-C5A271601AB3","versionEndExcluding":"7.0.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","matchCriteriaId":"E5910A9D-F60A-409A-B486-FE66BFEBA9B9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*","matchCriteriaId":"81DFF19E-9CF8-49C6-8C36-1E4038622933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker\n\ndrivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the\ndescriptor cursor by an attacker-supplied fip_dlen without ever\nrequiring dlen >= sizeof(struct fip_desc) in the default branch. The\nnamed descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked\ntheir per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor\n(fip_dtype >= 128, which the standard requires receivers to silently\nignore) skipped that check entirely.\n\nAn unauthenticated L2 peer on the FCoE control VLAN could hang\nfcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely\nby emitting one FIP CVL frame whose single descriptor had fip_dtype ==\nFIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes\nper iteration and the loop condition rlen >= sizeof(*desc) stayed true\nforever, blocking every subsequent FIP frame on that controller.\n\nTighten the outer dlen guard to also reject dlen < sizeof(struct\nfip_desc), so a malformed descriptor whose length cannot even cover the\ndescriptor header is rejected before the switch. This is the same\nlower-bound the named cases already apply and is the minimum scope that\ncloses the loop."}],"id":"CVE-2026-63890","lastModified":"2026-11-12T20:00:45.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-19T16:17:06.300","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14dd80a20a72ce334adcc2d67402360527065948"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/549859a1131052b07dff11a448e9f3221a40f260"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/80a0cd307205236ca28aa49bc553f58edcb9bf3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9eed1bd59937e6828b00d2f2dfef631d964f3636"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d179949d2175d2857d1c3a275a22bea58bcc5d36"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d537d29d51c8b808469e5adacf3e5a0092700738"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fda976f7390bb5d1e9b84ef11ebb17323038e0c6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63891.json b/data/2026/CVE-2026-63891.json index e16fde6f7b..9f8e2dad91 100644 --- a/data/2026/CVE-2026-63891.json +++ b/data/2026/CVE-2026-63891.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/thunderbolt/property.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2b5f47a710172c962ef42d1b732b04d2ad0dce21","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"95839a67ea56ca35732aad7f711404a3127cfe2d","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"0a84ab9271936c11e84e511bb52fc5682f8b6726","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"b4621e5ef63405c317a84b711faf3bd75b3c6a94","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"f31c6d220f455b5af63590302b30e1b932d14599","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"830c8a9b467e7d3a158483d37fa7dc13892b293a","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"ed9455ef4bd9babc90f92e526abe3fb68c1a8709","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"928abe19fbf0127003abcb1ea69cabc1c897d0ab","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/thunderbolt/property.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: property: Cap recursion depth in __tb_property_parse_dir()\n\nA DIRECTORY entry's value field is used as the dir_offset for a\nrecursive call into __tb_property_parse_dir() with no depth counter.\nA crafted peer that chains DIRECTORY entries into a back-reference\nloop drives the parser until the kernel stack is exhausted and the\nguard page fires. Any untrusted XDomain peer (cable, dock, in-line\ninspector, adjacent host) that reaches the PROPERTIES_REQUEST\ncontrol-plane exchange can trigger this without authentication.\n\nThread a depth counter through tb_property_parse() and\n__tb_property_parse_dir(), and reject blocks that exceed\nTB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any\nobserved legitimate XDomain layout.\n\nOperators who do not need XDomain host-to-host discovery can disable\nthe path entirely with thunderbolt.xdomain=0 on the kernel command\nline."}],"id":"CVE-2026-63891","lastModified":"2026-07-27T17:44:23.777","metrics":{},"published":"2026-07-19T16:17:06.440","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f31c6d220f455b5af63590302b30e1b932d14599"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/thunderbolt/property.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2b5f47a710172c962ef42d1b732b04d2ad0dce21","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"95839a67ea56ca35732aad7f711404a3127cfe2d","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"0a84ab9271936c11e84e511bb52fc5682f8b6726","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"b4621e5ef63405c317a84b711faf3bd75b3c6a94","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"f31c6d220f455b5af63590302b30e1b932d14599","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"830c8a9b467e7d3a158483d37fa7dc13892b293a","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"ed9455ef4bd9babc90f92e526abe3fb68c1a8709","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"},{"lessThan":"928abe19fbf0127003abcb1ea69cabc1c897d0ab","status":"affected","version":"cdae7c07e3e3509eaabc18c1640a55dc5b99c179","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/thunderbolt/property.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2E6634B-DED7-40B3-A18B-2140A791419F","versionEndExcluding":"5.10.259","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5E938CDF-D1C4-43D0-98DC-9E11B6B55801","versionEndExcluding":"5.15.210","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C4446623-5F2B-4DD8-8666-9FAAC285A757","versionEndExcluding":"6.1.176","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C","versionEndExcluding":"6.6.143","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1E73413E-0629-41AA-A4D3-5A3D10A0BD63","versionEndExcluding":"6.12.93","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0FCCB23A-7629-4386-93B6-B119237C4382","versionEndExcluding":"6.18.35","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9161A938-0FA8-44BC-95FE-C5A271601AB3","versionEndExcluding":"7.0.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","matchCriteriaId":"E5910A9D-F60A-409A-B486-FE66BFEBA9B9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*","matchCriteriaId":"81DFF19E-9CF8-49C6-8C36-1E4038622933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: property: Cap recursion depth in __tb_property_parse_dir()\n\nA DIRECTORY entry's value field is used as the dir_offset for a\nrecursive call into __tb_property_parse_dir() with no depth counter.\nA crafted peer that chains DIRECTORY entries into a back-reference\nloop drives the parser until the kernel stack is exhausted and the\nguard page fires. Any untrusted XDomain peer (cable, dock, in-line\ninspector, adjacent host) that reaches the PROPERTIES_REQUEST\ncontrol-plane exchange can trigger this without authentication.\n\nThread a depth counter through tb_property_parse() and\n__tb_property_parse_dir(), and reject blocks that exceed\nTB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any\nobserved legitimate XDomain layout.\n\nOperators who do not need XDomain host-to-host discovery can disable\nthe path entirely with thunderbolt.xdomain=0 on the kernel command\nline."}],"id":"CVE-2026-63891","lastModified":"2026-11-12T19:46:14.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-19T16:17:06.440","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f31c6d220f455b5af63590302b30e1b932d14599"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63979.json b/data/2026/CVE-2026-63979.json index 3c54b30fe3..8f434c10c8 100644 --- a/data/2026/CVE-2026-63979.json +++ b/data/2026/CVE-2026-63979.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/handshake/handshake-test.c","net/handshake/netlink.c","net/handshake/request.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b869e3e4ce1996df23b3efdbbe9a64c4ab81d745","status":"affected","version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","versionType":"git"},{"lessThan":"2f28dbb30b88eafab8d49aaec94710b4e12dea8e","status":"affected","version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","versionType":"git"},{"lessThan":"68eba6519cbd6359fb554a9720f3a3b6b2eba23f","status":"affected","version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","versionType":"git"},{"lessThan":"c06876d4fac38f35820946ee3b1be7d7da799cd4","status":"affected","version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","versionType":"git"},{"lessThan":"f4251190e58b209999c1ba9e6d2976136a1be055","status":"affected","version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/handshake/handshake-test.c","net/handshake/netlink.c","net/handshake/request.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.44","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: hand off the pinned file reference to accept_doit\n\nhandshake_req_next() removes the request from the per-net\npending list and drops hn_lock before handshake_nl_accept_doit()\nreads req->hr_sk->sk_socket and dereferences sock->file (once in\nFD_PREPARE() and again in get_file()). In that window a\nconsumer running tls_handshake_cancel() followed by sockfd_put()\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases\nsock->file. sock_release() then runs sock_orphan(), zeroing\nsk_socket, and frees the struct socket. The accept-side code\neither reads NULL through sk_socket or chases freed memory.\n\nThe submit-side sock_hold() does not prevent this. sk_refcnt\nprotects struct sock, but struct socket and sock->file are\nindependently refcounted via the file descriptor the consumer\nowns. Pinning sk leaves sock and sock->file unprotected.\n\nRetarget the accept-side dereferences at req->hr_file, which was\npinned at submit time, instead of req->hr_sk->sk_socket->file.\nPinning on its own is not sufficient: a consumer that cancels\nbetween handshake_req_next() returning and accept_doit reaching\nFD_PREPARE() takes the !remove_pending() branch in\nhandshake_req_cancel() and drops hr_file before the accept side\ntakes its own reference. Hand off an additional file reference\ninside handshake_req_next(), under hn_lock, so the accept side\noperates on a reference that no concurrent handshake_req_cancel()\ncan revoke. FD_PREPARE() consumes that handed-off reference,\neither by transferring it to the new fd in fd_publish() or by\ndropping it in the cleanup destructor on error; the explicit\nget_file() that previously balanced FD_PREPARE() is therefore\nredundant and goes away.\n\nUpdate handshake_req_cancel_test2 and _test3 to simulate the\nFD_PREPARE() consumption with an fput() so the kunit file-count\nassertions stay balanced."}],"id":"CVE-2026-63979","lastModified":"2026-10-21T13:19:18.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63979","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:34:33.675009Z","version":"2.0.3"}}]},"published":"2026-07-19T16:17:17.070","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2f28dbb30b88eafab8d49aaec94710b4e12dea8e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/68eba6519cbd6359fb554a9720f3a3b6b2eba23f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b869e3e4ce1996df23b3efdbbe9a64c4ab81d745"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c06876d4fac38f35820946ee3b1be7d7da799cd4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f4251190e58b209999c1ba9e6d2976136a1be055"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/handshake/handshake-test.c","net/handshake/netlink.c","net/handshake/request.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b869e3e4ce1996df23b3efdbbe9a64c4ab81d745","status":"affected","version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","versionType":"git"},{"lessThan":"2f28dbb30b88eafab8d49aaec94710b4e12dea8e","status":"affected","version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","versionType":"git"},{"lessThan":"68eba6519cbd6359fb554a9720f3a3b6b2eba23f","status":"affected","version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","versionType":"git"},{"lessThan":"c06876d4fac38f35820946ee3b1be7d7da799cd4","status":"affected","version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","versionType":"git"},{"lessThan":"f4251190e58b209999c1ba9e6d2976136a1be055","status":"affected","version":"3b3009ea8abb713b022d94fba95ec270cf6e7eae","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/handshake/handshake-test.c","net/handshake/netlink.c","net/handshake/request.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.44","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"54397279-D47C-4BF4-9212-AB36CC8762B1","versionEndExcluding":"6.6.160","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6209C78-7745-495E-92DC-3CD950D149EE","versionEndExcluding":"6.12.114","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CBC7A6FB-993F-4125-9FCD-DEC6EC80FA78","versionEndExcluding":"6.18.44","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9161A938-0FA8-44BC-95FE-C5A271601AB3","versionEndExcluding":"7.0.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","matchCriteriaId":"E5910A9D-F60A-409A-B486-FE66BFEBA9B9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*","matchCriteriaId":"81DFF19E-9CF8-49C6-8C36-1E4038622933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: hand off the pinned file reference to accept_doit\n\nhandshake_req_next() removes the request from the per-net\npending list and drops hn_lock before handshake_nl_accept_doit()\nreads req->hr_sk->sk_socket and dereferences sock->file (once in\nFD_PREPARE() and again in get_file()). In that window a\nconsumer running tls_handshake_cancel() followed by sockfd_put()\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases\nsock->file. sock_release() then runs sock_orphan(), zeroing\nsk_socket, and frees the struct socket. The accept-side code\neither reads NULL through sk_socket or chases freed memory.\n\nThe submit-side sock_hold() does not prevent this. sk_refcnt\nprotects struct sock, but struct socket and sock->file are\nindependently refcounted via the file descriptor the consumer\nowns. Pinning sk leaves sock and sock->file unprotected.\n\nRetarget the accept-side dereferences at req->hr_file, which was\npinned at submit time, instead of req->hr_sk->sk_socket->file.\nPinning on its own is not sufficient: a consumer that cancels\nbetween handshake_req_next() returning and accept_doit reaching\nFD_PREPARE() takes the !remove_pending() branch in\nhandshake_req_cancel() and drops hr_file before the accept side\ntakes its own reference. Hand off an additional file reference\ninside handshake_req_next(), under hn_lock, so the accept side\noperates on a reference that no concurrent handshake_req_cancel()\ncan revoke. FD_PREPARE() consumes that handed-off reference,\neither by transferring it to the new fd in fd_publish() or by\ndropping it in the cleanup destructor on error; the explicit\nget_file() that previously balanced FD_PREPARE() is therefore\nredundant and goes away.\n\nUpdate handshake_req_cancel_test2 and _test3 to simulate the\nFD_PREPARE() consumption with an fput() so the kunit file-count\nassertions stay balanced."}],"id":"CVE-2026-63979","lastModified":"2026-11-12T18:46:29.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63979","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:34:33.675009Z","version":"2.0.3"}}]},"published":"2026-07-19T16:17:17.070","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2f28dbb30b88eafab8d49aaec94710b4e12dea8e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/68eba6519cbd6359fb554a9720f3a3b6b2eba23f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b869e3e4ce1996df23b3efdbbe9a64c4ab81d745"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c06876d4fac38f35820946ee3b1be7d7da799cd4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4251190e58b209999c1ba9e6d2976136a1be055"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63980.json b/data/2026/CVE-2026-63980.json index 8b11e07ed8..432bbd3bb0 100644 --- a/data/2026/CVE-2026-63980.json +++ b/data/2026/CVE-2026-63980.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/handshake/netlink.c","net/handshake/request.c","net/handshake/tlshd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"06ab5978866fc2221b910347fd3e510ca8e7b1a4","status":"affected","version":"675b453e024154dd547921c6e6d5b58747ba7e0e","versionType":"git"},{"lessThan":"0866569fc36a56f568acd3900d354e3505932e09","status":"affected","version":"675b453e024154dd547921c6e6d5b58747ba7e0e","versionType":"git"},{"lessThan":"91898de9501a047ba67c6b864dcd403e00bdfbf5","status":"affected","version":"675b453e024154dd547921c6e6d5b58747ba7e0e","versionType":"git"},{"lessThan":"cc993e0927ec8bd98ea33377ada03295fcda0f24","status":"affected","version":"675b453e024154dd547921c6e6d5b58747ba7e0e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/handshake/netlink.c","net/handshake/request.c","net/handshake/tlshd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Use spin_lock_bh for hn_lock\n\nnvmet_tcp_state_change(), a socket callback that runs in BH context,\ncan reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue()\nand tls_handshake_cancel(). handshake_req_cancel() acquires\nhn->hn_lock with plain spin_lock(). If a process-context thread on\nthe same CPU holds hn->hn_lock when a softirq invokes the cancel path,\nthe lock attempt deadlocks. This is the only caller that invokes\ntls_handshake_cancel() from BH context; every other consumer calls it\nfrom process context.\n\nDeferring the cancel to process context in the NVMe target is not\nstraightforward: nvmet_tcp_schedule_release_queue() must call\ntls_handshake_cancel() atomically with its state transition to\nDISCONNECTING. If the cancel were deferred, the handshake completion\ncallback could fire in the window before the cancel runs, observe the\nunexpected state, and return without dropping its kref on the queue.\nReworking that interlock is considerably more invasive than hardening\nthe handshake lock. Convert all hn->hn_lock acquisitions from\nspin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is\nnever taken with softirqs enabled."}],"id":"CVE-2026-63980","lastModified":"2026-10-19T21:17:16.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63980","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:34:36.706161Z","version":"2.0.3"}}]},"published":"2026-07-19T16:17:17.170","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/06ab5978866fc2221b910347fd3e510ca8e7b1a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0866569fc36a56f568acd3900d354e3505932e09"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/91898de9501a047ba67c6b864dcd403e00bdfbf5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cc993e0927ec8bd98ea33377ada03295fcda0f24"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/handshake/netlink.c","net/handshake/request.c","net/handshake/tlshd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"06ab5978866fc2221b910347fd3e510ca8e7b1a4","status":"affected","version":"675b453e024154dd547921c6e6d5b58747ba7e0e","versionType":"git"},{"lessThan":"0866569fc36a56f568acd3900d354e3505932e09","status":"affected","version":"675b453e024154dd547921c6e6d5b58747ba7e0e","versionType":"git"},{"lessThan":"91898de9501a047ba67c6b864dcd403e00bdfbf5","status":"affected","version":"675b453e024154dd547921c6e6d5b58747ba7e0e","versionType":"git"},{"lessThan":"cc993e0927ec8bd98ea33377ada03295fcda0f24","status":"affected","version":"675b453e024154dd547921c6e6d5b58747ba7e0e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/handshake/netlink.c","net/handshake/request.c","net/handshake/tlshd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1E73413E-0629-41AA-A4D3-5A3D10A0BD63","versionEndExcluding":"6.12.93","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0FCCB23A-7629-4386-93B6-B119237C4382","versionEndExcluding":"6.18.35","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9161A938-0FA8-44BC-95FE-C5A271601AB3","versionEndExcluding":"7.0.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","matchCriteriaId":"E5910A9D-F60A-409A-B486-FE66BFEBA9B9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*","matchCriteriaId":"81DFF19E-9CF8-49C6-8C36-1E4038622933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Use spin_lock_bh for hn_lock\n\nnvmet_tcp_state_change(), a socket callback that runs in BH context,\ncan reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue()\nand tls_handshake_cancel(). handshake_req_cancel() acquires\nhn->hn_lock with plain spin_lock(). If a process-context thread on\nthe same CPU holds hn->hn_lock when a softirq invokes the cancel path,\nthe lock attempt deadlocks. This is the only caller that invokes\ntls_handshake_cancel() from BH context; every other consumer calls it\nfrom process context.\n\nDeferring the cancel to process context in the NVMe target is not\nstraightforward: nvmet_tcp_schedule_release_queue() must call\ntls_handshake_cancel() atomically with its state transition to\nDISCONNECTING. If the cancel were deferred, the handshake completion\ncallback could fire in the window before the cancel runs, observe the\nunexpected state, and return without dropping its kref on the queue.\nReworking that interlock is considerably more invasive than hardening\nthe handshake lock. Convert all hn->hn_lock acquisitions from\nspin_lock/spin_unlock to spin_lock_bh/spin_unlock_bh so the lock is\nnever taken with softirqs enabled."}],"id":"CVE-2026-63980","lastModified":"2026-11-12T18:48:26.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63980","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:34:36.706161Z","version":"2.0.3"}}]},"published":"2026-07-19T16:17:17.170","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/06ab5978866fc2221b910347fd3e510ca8e7b1a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0866569fc36a56f568acd3900d354e3505932e09"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/91898de9501a047ba67c6b864dcd403e00bdfbf5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc993e0927ec8bd98ea33377ada03295fcda0f24"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-63981.json b/data/2026/CVE-2026-63981.json index 9893cc8073..b1bcfec642 100644 --- a/data/2026/CVE-2026-63981.json +++ b/data/2026/CVE-2026-63981.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/act_mirred.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"25fc9352590f5ef21ebf290432bd768b336693bc","status":"affected","version":"906736728cea480a85803c67fafb1b0e78491922","versionType":"git"},{"lessThan":"34457de389fb64a01fdcc71177dfebe65fd2d362","status":"affected","version":"fe946a751d9b52b7c45ca34899723b314b79b249","versionType":"git"},{"lessThan":"a005fa5d7502eefec7ee6e1c01adadc06de2f9ad","status":"affected","version":"fe946a751d9b52b7c45ca34899723b314b79b249","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/act_mirred.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow\n\ntcf_mirred_act() checks sched_mirred_nest against MIRRED_NEST_LIMIT (4)\nto prevent deep recursion. However, when the action uses blockcast\n(tcfm_blockid != 0), the function returns at the tcf_blockcast() call\nBEFORE reaching the counter increment. As a result, the recursion\ncounter never advances and the limit check is entirely bypassed.\n\nWhen two devices share a TC egress block with a mirred blockcast rule,\na packet egressing on device A is mirrored to device B via blockcast;\ndevice B's egress TC re-enters tcf_mirred_act() via blockcast and\nmirrors back to A, creating an unbounded recursion loop:\n\n tcf_mirred_act -> tcf_blockcast -> tcf_mirred_to_dev -> dev_queue_xmit\n -> sch_handle_egress -> tcf_classify -> tcf_mirred_act -> (repeat)\n\nThis recursion continues until the kernel stack overflows.\n\nThe bug is reachable from an unprivileged user via\nunshare(CLONE_NEWUSER | CLONE_NEWNET): user namespaces grant\nCAP_NET_ADMIN in the new network namespace, which is sufficient to\ncreate dummy devices, attach clsact qdiscs with shared blocks, and\ninstall mirred blockcast filters.\n\n BUG: TASK stack guard page was hit at ffffc90000b7fff8\n Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI\n CPU: 2 UID: 1000 PID: 169 Comm: poc Not tainted 7.0.0-rc7-next-20260410\n RIP: 0010:xas_find+0x17/0x480\n Call Trace:\n xa_find+0x17b/0x1d0\n tcf_mirred_act+0x640/0x1060\n tcf_action_exec+0x400/0x530\n basic_classify+0x128/0x1d0\n tcf_classify+0xd83/0x1150\n tc_run+0x328/0x620\n __dev_queue_xmit+0x797/0x3100\n tcf_mirred_to_dev+0x7b1/0xf70\n tcf_mirred_act+0x68a/0x1060\n [repeating ~30+ times until stack overflow]\n Kernel panic - not syncing: Fatal exception in interrupt\n\nFix this by incrementing sched_mirred_nest before calling\ntcf_blockcast() and decrementing it on return, mirroring the\nnon-blockcast path. This ensures subsequent recursive entries see the\nupdated counter and are correctly limited by MIRRED_NEST_LIMIT."}],"id":"CVE-2026-63981","lastModified":"2026-07-30T14:51:11.223","metrics":{},"published":"2026-07-19T16:17:17.283","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/25fc9352590f5ef21ebf290432bd768b336693bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/34457de389fb64a01fdcc71177dfebe65fd2d362"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a005fa5d7502eefec7ee6e1c01adadc06de2f9ad"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/act_mirred.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"25fc9352590f5ef21ebf290432bd768b336693bc","status":"affected","version":"906736728cea480a85803c67fafb1b0e78491922","versionType":"git"},{"lessThan":"34457de389fb64a01fdcc71177dfebe65fd2d362","status":"affected","version":"fe946a751d9b52b7c45ca34899723b314b79b249","versionType":"git"},{"lessThan":"a005fa5d7502eefec7ee6e1c01adadc06de2f9ad","status":"affected","version":"fe946a751d9b52b7c45ca34899723b314b79b249","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/act_mirred.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9161A938-0FA8-44BC-95FE-C5A271601AB3","versionEndExcluding":"7.0.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","matchCriteriaId":"E5910A9D-F60A-409A-B486-FE66BFEBA9B9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*","matchCriteriaId":"81DFF19E-9CF8-49C6-8C36-1E4038622933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow\n\ntcf_mirred_act() checks sched_mirred_nest against MIRRED_NEST_LIMIT (4)\nto prevent deep recursion. However, when the action uses blockcast\n(tcfm_blockid != 0), the function returns at the tcf_blockcast() call\nBEFORE reaching the counter increment. As a result, the recursion\ncounter never advances and the limit check is entirely bypassed.\n\nWhen two devices share a TC egress block with a mirred blockcast rule,\na packet egressing on device A is mirrored to device B via blockcast;\ndevice B's egress TC re-enters tcf_mirred_act() via blockcast and\nmirrors back to A, creating an unbounded recursion loop:\n\n tcf_mirred_act -> tcf_blockcast -> tcf_mirred_to_dev -> dev_queue_xmit\n -> sch_handle_egress -> tcf_classify -> tcf_mirred_act -> (repeat)\n\nThis recursion continues until the kernel stack overflows.\n\nThe bug is reachable from an unprivileged user via\nunshare(CLONE_NEWUSER | CLONE_NEWNET): user namespaces grant\nCAP_NET_ADMIN in the new network namespace, which is sufficient to\ncreate dummy devices, attach clsact qdiscs with shared blocks, and\ninstall mirred blockcast filters.\n\n BUG: TASK stack guard page was hit at ffffc90000b7fff8\n Oops: stack guard page: 0000 [#1] SMP KASAN NOPTI\n CPU: 2 UID: 1000 PID: 169 Comm: poc Not tainted 7.0.0-rc7-next-20260410\n RIP: 0010:xas_find+0x17/0x480\n Call Trace:\n xa_find+0x17b/0x1d0\n tcf_mirred_act+0x640/0x1060\n tcf_action_exec+0x400/0x530\n basic_classify+0x128/0x1d0\n tcf_classify+0xd83/0x1150\n tc_run+0x328/0x620\n __dev_queue_xmit+0x797/0x3100\n tcf_mirred_to_dev+0x7b1/0xf70\n tcf_mirred_act+0x68a/0x1060\n [repeating ~30+ times until stack overflow]\n Kernel panic - not syncing: Fatal exception in interrupt\n\nFix this by incrementing sched_mirred_nest before calling\ntcf_blockcast() and decrementing it on return, mirroring the\nnon-blockcast path. This ensures subsequent recursive entries see the\nupdated counter and are correctly limited by MIRRED_NEST_LIMIT."}],"id":"CVE-2026-63981","lastModified":"2026-11-12T17:34:44.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-19T16:17:17.283","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25fc9352590f5ef21ebf290432bd768b336693bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34457de389fb64a01fdcc71177dfebe65fd2d362"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a005fa5d7502eefec7ee6e1c01adadc06de2f9ad"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63982.json b/data/2026/CVE-2026-63982.json index 7057ea7a9a..4b02611859 100644 --- a/data/2026/CVE-2026-63982.json +++ b/data/2026/CVE-2026-63982.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/act_mirred.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"66f4607fe788fc7d81bce0e2f7b3726ed2f71284","status":"affected","version":"906736728cea480a85803c67fafb1b0e78491922","versionType":"git"},{"lessThan":"45ac526a0d5733c3695946bd84ec57f24d8f5e66","status":"affected","version":"fe946a751d9b52b7c45ca34899723b314b79b249","versionType":"git"},{"lessThan":"db875221ab08d213a83bf30196ae8b64d55a3403","status":"affected","version":"fe946a751d9b52b7c45ca34899723b314b79b249","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/act_mirred.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop\n\nWhen mirred redirects to ingress (from either ingress or egress) the loop\nstate from sched_mirred_dev array dev is lost because of 1) the packet\ndeferral into the backlog and 2) the fact the sched_mirred_dev array is\ncleared. In such cases, if there was a loop we won't discover it.\n\nHere's a simple test to reproduce:\nip a add dev port0 10.10.10.11/24\n\ntc qdisc add dev port0 clsact\ntc filter add dev port0 egress protocol ip \\\n prio 10 matchall action mirred ingress redirect dev port1\n\ntc qdisc add dev port1 clsact\ntc filter add dev port1 ingress protocol ip \\\n prio 10 matchall action mirred egress redirect dev port0\n\nping -c 1 -W0.01 10.10.10.10"}],"id":"CVE-2026-63982","lastModified":"2026-07-30T14:51:11.223","metrics":{},"published":"2026-07-19T16:17:17.390","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/45ac526a0d5733c3695946bd84ec57f24d8f5e66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/66f4607fe788fc7d81bce0e2f7b3726ed2f71284"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/db875221ab08d213a83bf30196ae8b64d55a3403"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/act_mirred.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"66f4607fe788fc7d81bce0e2f7b3726ed2f71284","status":"affected","version":"906736728cea480a85803c67fafb1b0e78491922","versionType":"git"},{"lessThan":"45ac526a0d5733c3695946bd84ec57f24d8f5e66","status":"affected","version":"fe946a751d9b52b7c45ca34899723b314b79b249","versionType":"git"},{"lessThan":"db875221ab08d213a83bf30196ae8b64d55a3403","status":"affected","version":"fe946a751d9b52b7c45ca34899723b314b79b249","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/act_mirred.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9161A938-0FA8-44BC-95FE-C5A271601AB3","versionEndExcluding":"7.0.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","matchCriteriaId":"E5910A9D-F60A-409A-B486-FE66BFEBA9B9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*","matchCriteriaId":"81DFF19E-9CF8-49C6-8C36-1E4038622933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop\n\nWhen mirred redirects to ingress (from either ingress or egress) the loop\nstate from sched_mirred_dev array dev is lost because of 1) the packet\ndeferral into the backlog and 2) the fact the sched_mirred_dev array is\ncleared. In such cases, if there was a loop we won't discover it.\n\nHere's a simple test to reproduce:\nip a add dev port0 10.10.10.11/24\n\ntc qdisc add dev port0 clsact\ntc filter add dev port0 egress protocol ip \\\n prio 10 matchall action mirred ingress redirect dev port1\n\ntc qdisc add dev port1 clsact\ntc filter add dev port1 ingress protocol ip \\\n prio 10 matchall action mirred egress redirect dev port0\n\nping -c 1 -W0.01 10.10.10.10"}],"id":"CVE-2026-63982","lastModified":"2026-11-12T17:37:10.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-19T16:17:17.390","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45ac526a0d5733c3695946bd84ec57f24d8f5e66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66f4607fe788fc7d81bce0e2f7b3726ed2f71284"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/db875221ab08d213a83bf30196ae8b64d55a3403"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63983.json b/data/2026/CVE-2026-63983.json index 264a0c9970..3806960f49 100644 --- a/data/2026/CVE-2026-63983.json +++ b/data/2026/CVE-2026-63983.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/sch_netem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1a298a514ce766c6d0c232991a390fec67af81ad","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"},{"lessThan":"4ec3a8ca97394f17e73a4d8d4c79c1c78b322772","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"},{"lessThan":"cfb2616042767ab31260d4f39190c381bec8b12e","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"},{"lessThan":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/sch_netem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix packet loop on netem when duplicate is on\n\nWhen netem duplicates a packet it re-enqueues the copy at the root qdisc.\nIf another netem sits in the tree the copy can be duplicated\nagain, recursing until the stack or memory is exhausted.\n\nThe original duplication guard temporarily zeroed q->duplicate around\nthe re-enqueue, but that does not cover all cases because it is\nper-qdisc state shared across all concurrent enqueue paths\nand is not safe without additional locking.\n\nUse the skb tc_depth field introduced in an earlier patch:\n - increment it on the duplicate before re-enqueue\n - skip duplication for any skb whose tc_depth is already non-zero.\n\nThis marks the packet itself rather than mutating qdisc state,\ntherefore it is safe regardless of tree topology or concurrency."}],"id":"CVE-2026-63983","lastModified":"2026-10-15T11:17:38.033","metrics":{},"published":"2026-07-19T16:17:17.490","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1a298a514ce766c6d0c232991a390fec67af81ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4ec3a8ca97394f17e73a4d8d4c79c1c78b322772"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cfb2616042767ab31260d4f39190c381bec8b12e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/sch_netem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1a298a514ce766c6d0c232991a390fec67af81ad","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"},{"lessThan":"4ec3a8ca97394f17e73a4d8d4c79c1c78b322772","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"},{"lessThan":"cfb2616042767ab31260d4f39190c381bec8b12e","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"},{"lessThan":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/sch_netem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AF9BD1A1-2FA3-44C5-BB5F-C9D7A929B38D","versionEndExcluding":"6.12.93","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C630600E-44E2-4A75-9937-F6EEF31F171F","versionEndExcluding":"6.18.57","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9161A938-0FA8-44BC-95FE-C5A271601AB3","versionEndExcluding":"7.0.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","matchCriteriaId":"E5910A9D-F60A-409A-B486-FE66BFEBA9B9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*","matchCriteriaId":"81DFF19E-9CF8-49C6-8C36-1E4038622933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix packet loop on netem when duplicate is on\n\nWhen netem duplicates a packet it re-enqueues the copy at the root qdisc.\nIf another netem sits in the tree the copy can be duplicated\nagain, recursing until the stack or memory is exhausted.\n\nThe original duplication guard temporarily zeroed q->duplicate around\nthe re-enqueue, but that does not cover all cases because it is\nper-qdisc state shared across all concurrent enqueue paths\nand is not safe without additional locking.\n\nUse the skb tc_depth field introduced in an earlier patch:\n - increment it on the duplicate before re-enqueue\n - skip duplication for any skb whose tc_depth is already non-zero.\n\nThis marks the packet itself rather than mutating qdisc state,\ntherefore it is safe regardless of tree topology or concurrency."}],"id":"CVE-2026-63983","lastModified":"2026-11-12T17:40:12.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-19T16:17:17.490","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a298a514ce766c6d0c232991a390fec67af81ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4ec3a8ca97394f17e73a4d8d4c79c1c78b322772"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cfb2616042767ab31260d4f39190c381bec8b12e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-63984.json b/data/2026/CVE-2026-63984.json index 4a2e5906f6..36bf611fbe 100644 --- a/data/2026/CVE-2026-63984.json +++ b/data/2026/CVE-2026-63984.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/exthdrs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"75b3680047bf09af8e7e471a7a6ddf2ce5847f56","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"fd238c51b0fa5390cceca9f1ac5a9ffda8063eed","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"3618b34942b76471d044369bfd30d58c39068bf1","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"97e06791368c01f0ad2a4b3269c2abe19485ca32","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"de02fc049352af5a9595f015511222d0a85c326b","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"6fe1cb312038516cb4d9fa089d700af7059f1a64","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"c0487a9c1e116cf349e2d1f302d9019670460858","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"9d5e7a46a9f6d8f503b41bfefef70659845f1679","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/exthdrs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()\n\nipv6_rpl_srh_decompress() computes:\n\n outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3);\n\nhdrlen is __u8. For n >= 127 the result exceeds 255 and silently\ntruncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16):\n\n (128 * 16) >> 3 = 256, truncated to 0 as __u8\n\nThe caller in ipv6_rpl_srh_rcv() then places the compressed header\nat buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8,\nbut the decompressed region occupies buf[0..2055] (8-byte header\nplus 128 full addresses). The compressed header overlaps the\ndecompressed data, and ipv6_rpl_srh_compress() writes into this\noverlap, corrupting the routing header of the forwarded packet.\n\nThe existing guard at exthdrs.c:546 checks (n + 1) > 255, which\nprevents n+1 from overflowing unsigned char (the segments_left\nfield), but does not prevent the computed hdrlen from overflowing\n__u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not\nfit.\n\nTighten the bound to (n + 1) > 127. This caps n at 126, giving\nhdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed\nheader then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly\npast the decompressed region (buf[0..2039]). No overlap. 127\nsegments is well beyond any realistic RPL deployment."}],"id":"CVE-2026-63984","lastModified":"2026-10-19T21:17:16.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63984","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:34:39.184194Z","version":"2.0.3"}}]},"published":"2026-07-19T16:17:17.590","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/exthdrs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"75b3680047bf09af8e7e471a7a6ddf2ce5847f56","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"fd238c51b0fa5390cceca9f1ac5a9ffda8063eed","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"3618b34942b76471d044369bfd30d58c39068bf1","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"97e06791368c01f0ad2a4b3269c2abe19485ca32","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"de02fc049352af5a9595f015511222d0a85c326b","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"6fe1cb312038516cb4d9fa089d700af7059f1a64","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"c0487a9c1e116cf349e2d1f302d9019670460858","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"},{"lessThan":"9d5e7a46a9f6d8f503b41bfefef70659845f1679","status":"affected","version":"8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/exthdrs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8CC4A95D-0251-4FDF-8AFB-BBE0FAD54A79","versionEndExcluding":"5.10.259","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5E938CDF-D1C4-43D0-98DC-9E11B6B55801","versionEndExcluding":"5.15.210","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C4446623-5F2B-4DD8-8666-9FAAC285A757","versionEndExcluding":"6.1.176","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C","versionEndExcluding":"6.6.143","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1E73413E-0629-41AA-A4D3-5A3D10A0BD63","versionEndExcluding":"6.12.93","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0FCCB23A-7629-4386-93B6-B119237C4382","versionEndExcluding":"6.18.35","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9161A938-0FA8-44BC-95FE-C5A271601AB3","versionEndExcluding":"7.0.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","matchCriteriaId":"EC732D08-5F7B-46D9-B154-E60C7F4F0A97","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*","matchCriteriaId":"E5910A9D-F60A-409A-B486-FE66BFEBA9B9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*","matchCriteriaId":"81DFF19E-9CF8-49C6-8C36-1E4038622933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()\n\nipv6_rpl_srh_decompress() computes:\n\n outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3);\n\nhdrlen is __u8. For n >= 127 the result exceeds 255 and silently\ntruncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16):\n\n (128 * 16) >> 3 = 256, truncated to 0 as __u8\n\nThe caller in ipv6_rpl_srh_rcv() then places the compressed header\nat buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8,\nbut the decompressed region occupies buf[0..2055] (8-byte header\nplus 128 full addresses). The compressed header overlaps the\ndecompressed data, and ipv6_rpl_srh_compress() writes into this\noverlap, corrupting the routing header of the forwarded packet.\n\nThe existing guard at exthdrs.c:546 checks (n + 1) > 255, which\nprevents n+1 from overflowing unsigned char (the segments_left\nfield), but does not prevent the computed hdrlen from overflowing\n__u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not\nfit.\n\nTighten the bound to (n + 1) > 127. This caps n at 126, giving\nhdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed\nheader then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly\npast the decompressed region (buf[0..2039]). No overlap. 127\nsegments is well beyond any realistic RPL deployment."}],"id":"CVE-2026-63984","lastModified":"2026-11-12T18:49:59.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63984","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:34:39.184194Z","version":"2.0.3"}}]},"published":"2026-07-19T16:17:17.590","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64454.json b/data/2026/CVE-2026-64454.json index 71da2ea8cc..9cd09d23e0 100644 --- a/data/2026/CVE-2026-64454.json +++ b/data/2026/CVE-2026-64454.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/dwc3/gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b399be2958456efe1b64b19c55a54a24e9035769","status":"affected","version":"20351ddb1f41cfb3ae20e105425ef43a28393d76","versionType":"git"},{"lessThan":"48958478cb8dbc429a5b19f36e866b63d6297d1d","status":"affected","version":"ad43004fd5326bec4466ecc8a07fe0e570b553ca","versionType":"git"},{"lessThan":"5e5798880eb1533a7de6fb68eb14b2d8202ebf76","status":"affected","version":"c8540870af4ce6ddeb27a7bb5498b75fb29b643c","versionType":"git"},{"lessThan":"e0e4f15d4225fb7156cc0e3c21eb8953114f9b89","status":"affected","version":"c8540870af4ce6ddeb27a7bb5498b75fb29b643c","versionType":"git"},{"lessThan":"c4e232bd07fe2b69a6e5c380db41dd36b95e0524","status":"affected","version":"c8540870af4ce6ddeb27a7bb5498b75fb29b643c","versionType":"git"},{"lessThan":"642e04f5c292d04070ae6e4374fbf14cc40a2465","status":"affected","version":"c8540870af4ce6ddeb27a7bb5498b75fb29b643c","versionType":"git"},{"lessThan":"010382937fb69892b3469ac4d30af072262f59e8","status":"affected","version":"c8540870af4ce6ddeb27a7bb5498b75fb29b643c","versionType":"git"},{"status":"affected","version":"06684c72b6b153dc434bb6ccebbb49f4cd812b5e","versionType":"git"},{"lessThan":"5.15.212","status":"affected","version":"5.15.128","versionType":"semver"},{"lessThan":"6.1.178","status":"affected","version":"6.1.30","versionType":"semver"},{"lessThan":"6.4","status":"affected","version":"6.3.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/dwc3/gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: run gadget disconnect from sleepable suspend context\n\ndwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls\ndwc3_disconnect_gadget(). For async callbacks that helper only uses\nplain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback\nstill runs with IRQs disabled and any sleepable callback trips Lockdep.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the dwc3_gadget_suspend() ->\ndwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and\nLockdep reported:\n\n BUG: sleeping function called from invalid context\n gadget_disconnect+0x21/0x39 [vuln_msv]\n dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv]\n\nKeep the disconnect callback selection in one common helper, but add a\nsleepable suspend-side wrapper which snapshots the callback under\ndwc->lock and then runs it after spin_unlock_irqrestore(). The regular\nevent path still uses the existing spin_unlock()/spin_lock() window."}],"id":"CVE-2026-64454","lastModified":"2026-11-06T17:18:54.730","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64454","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:38:45.590842Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:30.407","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/010382937fb69892b3469ac4d30af072262f59e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/48958478cb8dbc429a5b19f36e866b63d6297d1d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5e5798880eb1533a7de6fb68eb14b2d8202ebf76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/642e04f5c292d04070ae6e4374fbf14cc40a2465"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b399be2958456efe1b64b19c55a54a24e9035769"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c4e232bd07fe2b69a6e5c380db41dd36b95e0524"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e0e4f15d4225fb7156cc0e3c21eb8953114f9b89"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/dwc3/gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b399be2958456efe1b64b19c55a54a24e9035769","status":"affected","version":"20351ddb1f41cfb3ae20e105425ef43a28393d76","versionType":"git"},{"lessThan":"48958478cb8dbc429a5b19f36e866b63d6297d1d","status":"affected","version":"ad43004fd5326bec4466ecc8a07fe0e570b553ca","versionType":"git"},{"lessThan":"5e5798880eb1533a7de6fb68eb14b2d8202ebf76","status":"affected","version":"c8540870af4ce6ddeb27a7bb5498b75fb29b643c","versionType":"git"},{"lessThan":"e0e4f15d4225fb7156cc0e3c21eb8953114f9b89","status":"affected","version":"c8540870af4ce6ddeb27a7bb5498b75fb29b643c","versionType":"git"},{"lessThan":"c4e232bd07fe2b69a6e5c380db41dd36b95e0524","status":"affected","version":"c8540870af4ce6ddeb27a7bb5498b75fb29b643c","versionType":"git"},{"lessThan":"642e04f5c292d04070ae6e4374fbf14cc40a2465","status":"affected","version":"c8540870af4ce6ddeb27a7bb5498b75fb29b643c","versionType":"git"},{"lessThan":"010382937fb69892b3469ac4d30af072262f59e8","status":"affected","version":"c8540870af4ce6ddeb27a7bb5498b75fb29b643c","versionType":"git"},{"status":"affected","version":"06684c72b6b153dc434bb6ccebbb49f4cd812b5e","versionType":"git"},{"lessThan":"5.15.212","status":"affected","version":"5.15.128","versionType":"semver"},{"lessThan":"6.1.178","status":"affected","version":"6.1.30","versionType":"semver"},{"lessThan":"6.4","status":"affected","version":"6.3.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/dwc3/gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A7D3EC7B-CBA6-4ECE-ABA4-7F97C094D75B","versionEndExcluding":"5.15.212","versionStartIncluding":"5.15.128","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EFE68FEC-B35B-4695-8F0B-6FBF290BC616","versionEndExcluding":"6.1.178","versionStartIncluding":"6.1.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A1C4BF07-55E0-4ECE-B2BC-1C398FA64210","versionEndExcluding":"6.4","versionStartIncluding":"6.3.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CBC2AB5D-A411-41C4-9451-00E41A37FFD3","versionEndExcluding":"6.6.145","versionStartIncluding":"6.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*","matchCriteriaId":"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:rc3:*:*:*:*:*:*","matchCriteriaId":"A717BA5B-D535-46A0-A329-A25FE5CEC588","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:rc4:*:*:*:*:*:*","matchCriteriaId":"89CC80C6-F1EE-4AC7-BD21-DB3217BADE87","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:rc5:*:*:*:*:*:*","matchCriteriaId":"41EACEA1-FB69-4AF2-BC52-D39489858D42","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:rc6:*:*:*:*:*:*","matchCriteriaId":"9E1C36BE-F9D8-40B6-8281-5B8F9B42322D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:rc7:*:*:*:*:*:*","matchCriteriaId":"1D6CAA59-F0EF-4E0B-8C23-EC9535008572","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: run gadget disconnect from sleepable suspend context\n\ndwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls\ndwc3_disconnect_gadget(). For async callbacks that helper only uses\nplain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback\nstill runs with IRQs disabled and any sleepable callback trips Lockdep.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the dwc3_gadget_suspend() ->\ndwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and\nLockdep reported:\n\n BUG: sleeping function called from invalid context\n gadget_disconnect+0x21/0x39 [vuln_msv]\n dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv]\n\nKeep the disconnect callback selection in one common helper, but add a\nsleepable suspend-side wrapper which snapshots the callback under\ndwc->lock and then runs it after spin_unlock_irqrestore(). The regular\nevent path still uses the existing spin_unlock()/spin_lock() window."}],"id":"CVE-2026-64454","lastModified":"2026-11-12T17:43:45.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64454","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:38:45.590842Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:30.407","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/010382937fb69892b3469ac4d30af072262f59e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48958478cb8dbc429a5b19f36e866b63d6297d1d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e5798880eb1533a7de6fb68eb14b2d8202ebf76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/642e04f5c292d04070ae6e4374fbf14cc40a2465"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b399be2958456efe1b64b19c55a54a24e9035769"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4e232bd07fe2b69a6e5c380db41dd36b95e0524"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0e4f15d4225fb7156cc0e3c21eb8953114f9b89"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64455.json b/data/2026/CVE-2026-64455.json index f80dfd4677..1b33d568c5 100644 --- a/data/2026/CVE-2026-64455.json +++ b/data/2026/CVE-2026-64455.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/misc/chaoskey.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fe7a0f4be283b40dd592540027279735120d0d6f","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"5ec61fbef9ec5635c492ae63dfb5d13f2bdf1023","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"f3e409476ad0703c54c14f245e4e143c8124e1bd","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"6c82f88bc7a8458d5c60f9b354c4d32d233f0cac","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"3ad5fbcced4e9c2b0fee3c1b76289a147fc35b89","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"2a52d55c86a429dac47886b8424e67f90b001e67","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"8f50613bff228272577893aa10a346a2f3063e49","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"abf76d3239dee97b66e7241ad04811f1ce562e28","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/misc/chaoskey.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.1"},{"lessThan":"4.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: chaoskey: Fix slab-use-after-free in chaoskey_release()\n\nThe chaoskey driver has a use-after-free bug in its release routine.\nIf the user closes the device file after the USB device has been\nunplugged, a debugging log statement will try to access the\nusb_interface structure after it has been deallocated:\n\n\tBUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406)\n\tRead of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106\n\n\tHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tCall Trace:\n\t \n\t dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n\t print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n\t kasan_report (mm/kasan/report.c:595)\n\t dev_driver_string (drivers/base/core.c:2406)\n\t __dynamic_dev_dbg (lib/dynamic_debug.c:906)\n\t chaoskey_release (drivers/usb/misc/chaoskey.c:323)\n\t __fput (fs/file_table.c:510)\n\t fput_close_sync (fs/file_table.c:615)\n\t __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)\n\t do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n\t entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nThe driver's last reference to the interface structure is dropped in\nthe chaoskey_free() routine, so the code must not use the interface --\neven in a debugging statement -- after that routine returns.\n(Exception: If we know that another reference is held by someone else,\nsuch as the device core while the disconnect routine runs, there's no\nproblem. Thanks to Johan Hovold for pointing this out.)\n\nSince the bad access is part of an unimportant debugging statement,\nwe can fix the problem simply by removing the whole statement."}],"id":"CVE-2026-64455","lastModified":"2026-11-06T17:18:54.900","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:38:50.828275Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:30.537","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2a52d55c86a429dac47886b8424e67f90b001e67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3ad5fbcced4e9c2b0fee3c1b76289a147fc35b89"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5ec61fbef9ec5635c492ae63dfb5d13f2bdf1023"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6c82f88bc7a8458d5c60f9b354c4d32d233f0cac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8f50613bff228272577893aa10a346a2f3063e49"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/abf76d3239dee97b66e7241ad04811f1ce562e28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f3e409476ad0703c54c14f245e4e143c8124e1bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fe7a0f4be283b40dd592540027279735120d0d6f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/misc/chaoskey.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fe7a0f4be283b40dd592540027279735120d0d6f","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"5ec61fbef9ec5635c492ae63dfb5d13f2bdf1023","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"f3e409476ad0703c54c14f245e4e143c8124e1bd","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"6c82f88bc7a8458d5c60f9b354c4d32d233f0cac","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"3ad5fbcced4e9c2b0fee3c1b76289a147fc35b89","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"2a52d55c86a429dac47886b8424e67f90b001e67","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"8f50613bff228272577893aa10a346a2f3063e49","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"},{"lessThan":"abf76d3239dee97b66e7241ad04811f1ce562e28","status":"affected","version":"66e3e591891da9899a8990792da080432531ffd4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/misc/chaoskey.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.1"},{"lessThan":"4.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2C338AC7-51C3-43D3-8E70-66343021315C","versionEndExcluding":"5.10.261","versionStartIncluding":"4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: chaoskey: Fix slab-use-after-free in chaoskey_release()\n\nThe chaoskey driver has a use-after-free bug in its release routine.\nIf the user closes the device file after the USB device has been\nunplugged, a debugging log statement will try to access the\nusb_interface structure after it has been deallocated:\n\n\tBUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406)\n\tRead of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106\n\n\tHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tCall Trace:\n\t \n\t dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n\t print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n\t kasan_report (mm/kasan/report.c:595)\n\t dev_driver_string (drivers/base/core.c:2406)\n\t __dynamic_dev_dbg (lib/dynamic_debug.c:906)\n\t chaoskey_release (drivers/usb/misc/chaoskey.c:323)\n\t __fput (fs/file_table.c:510)\n\t fput_close_sync (fs/file_table.c:615)\n\t __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)\n\t do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n\t entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nThe driver's last reference to the interface structure is dropped in\nthe chaoskey_free() routine, so the code must not use the interface --\neven in a debugging statement -- after that routine returns.\n(Exception: If we know that another reference is held by someone else,\nsuch as the device core while the disconnect routine runs, there's no\nproblem. Thanks to Johan Hovold for pointing this out.)\n\nSince the bad access is part of an unimportant debugging statement,\nwe can fix the problem simply by removing the whole statement."}],"id":"CVE-2026-64455","lastModified":"2026-11-12T17:44:42.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:38:50.828275Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:30.537","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2a52d55c86a429dac47886b8424e67f90b001e67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3ad5fbcced4e9c2b0fee3c1b76289a147fc35b89"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5ec61fbef9ec5635c492ae63dfb5d13f2bdf1023"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c82f88bc7a8458d5c60f9b354c4d32d233f0cac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f50613bff228272577893aa10a346a2f3063e49"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/abf76d3239dee97b66e7241ad04811f1ce562e28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f3e409476ad0703c54c14f245e4e143c8124e1bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fe7a0f4be283b40dd592540027279735120d0d6f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64456.json b/data/2026/CVE-2026-64456.json index 168e80d8be..484fcfc646 100644 --- a/data/2026/CVE-2026-64456.json +++ b/data/2026/CVE-2026-64456.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/char/hw_random/virtio-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"63335e7b638ae70028ae285bb95153874a8bc852","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"2e788948ff2a13358a303af112497a63201c5739","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"fde19b0d4eeabae042519313c843fe6f27d41e9d","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"81dd21b5f0c299cc7b5bf84f04a61938559d20e6","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"285e17c44e3873a73460f294acbd64018ff64385","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"92d5736a62040ec1cfff23ea57e6599301690ad5","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"e3046eeada299f917a8ad883af4434bfb86556b1","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/char/hw_random/virtio-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.26"},{"lessThan":"2.6.26","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: virtio: clamp device-reported used.len at copy_data()\n\nrandom_recv_done() stores the device-reported used.len directly into\nvi->data_avail. copy_data() then indexes vi->data[] using\nvi->data_idx (advanced by previous copy_data() calls) and issues a\nmemcpy() without re-validating either value against the posted\nbuffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32\nor 64).\n\nA malicious or buggy virtio-rng backend can set used.len beyond\nsizeof(vi->data), steering the memcpy() past the end of the inline\narray into adjacent kmalloc-1k slab bytes. hwrng_fillfn() mixes\nthose bytes into the guest RNG, and guest root can also observe\nthem directly via /dev/hwrng.\n\nConcrete impact is inside the guest:\n\n - Memory-safety / hardening: any virtio-rng backend that\n over-reports used.len causes the driver to read past vi->data\n into unrelated slab contents. hwrng_fillfn() is a kernel thread\n that runs as soon as the device is probed; no guest userspace\n interaction is required to first-trigger the OOB.\n\n - Cross-boundary leak (confidential-compute threat model): a\n malicious hypervisor cooperating with a malicious or compromised\n guest root userspace can use /dev/hwrng as a leak channel for\n guest-kernel heap data. The host sets a large used.len, guest\n root reads /dev/hwrng, and the returned bytes contain guest\n kernel slab contents that were adjacent to vi->data. In\n practice, confidential-compute guests (SEV-SNP, TDX) usually\n disable virtio-rng entirely, so this path is narrow, but the\n fix is still worth carrying because the underlying\n memory-safety bug contaminates the guest RNG on any host.\n\nKASAN confirms the OOB on a 7.1-rc4 guest whose virtio-rng backend\nhas been patched to report used.len = 0x10000:\n\n BUG: KASAN: slab-out-of-bounds in virtio_read+0x394/0x5d0\n Read of size 64 at addr ffff88800ae0ba20 by task hwrng/52\n Call Trace:\n __asan_memcpy+0x23/0x60\n virtio_read+0x394/0x5d0\n hwrng_fillfn+0xb2/0x470\n kthread+0x2cc/0x3a0\n Allocated by task 1:\n probe_common+0xa5/0x660\n virtio_dev_probe+0x549/0xbc0\n The buggy address belongs to the object at ffff88800ae0b800\n which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 0 bytes to the right of\n allocated 544-byte region [ffff88800ae0b800, ffff88800ae0ba20)\n\nSame class of bug as commit c04db81cd028 (\"net/9p: Fix buffer\noverflow in USB transport layer\"), which hardened\nusb9pfs_rx_complete() against unchecked device-reported length in\nthe USB 9p transport.\n\nWith the clamp at point of use and array_index_nospec() in place,\nthe same harness boots cleanly: copy_data() returns zero for the\nbogus report, the device-supplied bytes after data_idx are\ndiscarded, and the driver issues a fresh request."}],"id":"CVE-2026-64456","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:09.503091Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:30.677","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/285e17c44e3873a73460f294acbd64018ff64385"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2e788948ff2a13358a303af112497a63201c5739"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/63335e7b638ae70028ae285bb95153874a8bc852"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/81dd21b5f0c299cc7b5bf84f04a61938559d20e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/92d5736a62040ec1cfff23ea57e6599301690ad5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e3046eeada299f917a8ad883af4434bfb86556b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fde19b0d4eeabae042519313c843fe6f27d41e9d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/char/hw_random/virtio-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"63335e7b638ae70028ae285bb95153874a8bc852","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"2e788948ff2a13358a303af112497a63201c5739","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"fde19b0d4eeabae042519313c843fe6f27d41e9d","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"81dd21b5f0c299cc7b5bf84f04a61938559d20e6","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"285e17c44e3873a73460f294acbd64018ff64385","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"92d5736a62040ec1cfff23ea57e6599301690ad5","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"e3046eeada299f917a8ad883af4434bfb86556b1","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/char/hw_random/virtio-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.26"},{"lessThan":"2.6.26","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EFF008D1-8A48-4617-BDDB-FF64FB98B745","versionEndExcluding":"5.10.261","versionStartIncluding":"2.6.26.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.26:-:*:*:*:*:*:*","matchCriteriaId":"2904D4F1-8EE3-49BD-8EA8-5C7FA05E28F3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.26:rc5:*:*:*:*:*:*","matchCriteriaId":"8B8E0DDC-7566-4EF9-9A8F-B1870CA83144","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.26:rc6:*:*:*:*:*:*","matchCriteriaId":"764777FB-FD1E-4930-899C-AC5D2DF293E8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.26:rc7:*:*:*:*:*:*","matchCriteriaId":"95461D7E-A080-4B9E-BC72-6BDBC1C1A447","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.26:rc8:*:*:*:*:*:*","matchCriteriaId":"D913E879-38EC-46AE-9F20-5D3E5F2CDCC2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.26:rc9:*:*:*:*:*:*","matchCriteriaId":"B264E869-1A6C-4D85-9944-2E4EB523CD82","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: virtio: clamp device-reported used.len at copy_data()\n\nrandom_recv_done() stores the device-reported used.len directly into\nvi->data_avail. copy_data() then indexes vi->data[] using\nvi->data_idx (advanced by previous copy_data() calls) and issues a\nmemcpy() without re-validating either value against the posted\nbuffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32\nor 64).\n\nA malicious or buggy virtio-rng backend can set used.len beyond\nsizeof(vi->data), steering the memcpy() past the end of the inline\narray into adjacent kmalloc-1k slab bytes. hwrng_fillfn() mixes\nthose bytes into the guest RNG, and guest root can also observe\nthem directly via /dev/hwrng.\n\nConcrete impact is inside the guest:\n\n - Memory-safety / hardening: any virtio-rng backend that\n over-reports used.len causes the driver to read past vi->data\n into unrelated slab contents. hwrng_fillfn() is a kernel thread\n that runs as soon as the device is probed; no guest userspace\n interaction is required to first-trigger the OOB.\n\n - Cross-boundary leak (confidential-compute threat model): a\n malicious hypervisor cooperating with a malicious or compromised\n guest root userspace can use /dev/hwrng as a leak channel for\n guest-kernel heap data. The host sets a large used.len, guest\n root reads /dev/hwrng, and the returned bytes contain guest\n kernel slab contents that were adjacent to vi->data. In\n practice, confidential-compute guests (SEV-SNP, TDX) usually\n disable virtio-rng entirely, so this path is narrow, but the\n fix is still worth carrying because the underlying\n memory-safety bug contaminates the guest RNG on any host.\n\nKASAN confirms the OOB on a 7.1-rc4 guest whose virtio-rng backend\nhas been patched to report used.len = 0x10000:\n\n BUG: KASAN: slab-out-of-bounds in virtio_read+0x394/0x5d0\n Read of size 64 at addr ffff88800ae0ba20 by task hwrng/52\n Call Trace:\n __asan_memcpy+0x23/0x60\n virtio_read+0x394/0x5d0\n hwrng_fillfn+0xb2/0x470\n kthread+0x2cc/0x3a0\n Allocated by task 1:\n probe_common+0xa5/0x660\n virtio_dev_probe+0x549/0xbc0\n The buggy address belongs to the object at ffff88800ae0b800\n which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 0 bytes to the right of\n allocated 544-byte region [ffff88800ae0b800, ffff88800ae0ba20)\n\nSame class of bug as commit c04db81cd028 (\"net/9p: Fix buffer\noverflow in USB transport layer\"), which hardened\nusb9pfs_rx_complete() against unchecked device-reported length in\nthe USB 9p transport.\n\nWith the clamp at point of use and array_index_nospec() in place,\nthe same harness boots cleanly: copy_data() returns zero for the\nbogus report, the device-supplied bytes after data_idx are\ndiscarded, and the driver issues a fresh request."}],"id":"CVE-2026-64456","lastModified":"2026-11-12T20:19:36.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:09.503091Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:30.677","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/285e17c44e3873a73460f294acbd64018ff64385"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e788948ff2a13358a303af112497a63201c5739"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63335e7b638ae70028ae285bb95153874a8bc852"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/81dd21b5f0c299cc7b5bf84f04a61938559d20e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/92d5736a62040ec1cfff23ea57e6599301690ad5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e3046eeada299f917a8ad883af4434bfb86556b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fde19b0d4eeabae042519313c843fe6f27d41e9d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64457.json b/data/2026/CVE-2026-64457.json index acbd01c8c4..e9de8abada 100644 --- a/data/2026/CVE-2026-64457.json +++ b/data/2026/CVE-2026-64457.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/virtio/virtio_pci_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"41e6dc1a10036c9f47057033f19af7e52ec464b6","status":"affected","version":"89a1c435aec269d109ed46ca7bbb10fa8edf7ace","versionType":"git"},{"lessThan":"075bc3c779e1ea7294afabdcb7e0a49536959b28","status":"affected","version":"89a1c435aec269d109ed46ca7bbb10fa8edf7ace","versionType":"git"},{"lessThan":"64a4c0befa77bcc01076aec9f93863ffd4ed06b7","status":"affected","version":"89a1c435aec269d109ed46ca7bbb10fa8edf7ace","versionType":"git"},{"lessThan":"f7d380fb525c13bdd114369a1979c80c346e6abc","status":"affected","version":"89a1c435aec269d109ed46ca7bbb10fa8edf7ace","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/virtio/virtio_pci_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_pci: fix vq info pointer lookup via wrong index\n\nUnbinding a virtio balloon device:\n\n echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind\n\ntriggers a NULL pointer dereference. The dmesg says:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n [...]\n RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0\n Call Trace:\n \n vp_del_vqs+0x121/0x230\n remove_common+0x135/0x150\n virtballoon_remove+0xee/0x100\n virtio_dev_remove+0x3b/0x80\n device_release_driver_internal+0x187/0x2c0\n unbind_store+0xb9/0xe0\n kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180\n vfs_write+0x2a9/0x3b0\n ksys_write+0x5c/0xd0\n do_syscall_64+0x54/0x230\n entry_SYSCALL_64_after_hwframe+0x29/0x31\n [...]\n \n\nThe virtio_balloon device registers 5 queues (inflate, deflate, stats,\nfree_page, reporting) but only the first two are unconditional. The\nstats, free_page and reporting queues are each conditional on their\nrespective feature bits. When any of these features are absent, the\ncorresponding vqs_info entry has name == NULL, creating holes in the\narray.\n\nThe root cause is an indexing mismatch introduced when vq info storage\nwas changed to be passed as an argument. vp_find_vqs_msix() and\nvp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where 'i'\nis the caller's sparse array index. However, the virtqueue itself gets\nvq->index assigned from queue_idx, a dense index that skips NULL\nentries. When holes exist, 'i' and queue_idx diverge. Later,\nvp_del_vqs() looks up info via vp_dev->vqs[vq->index] using the dense\nindex into the sparsely-populated array, and hits NULL.\n\nFix this by storing info at vp_dev->vqs[queue_idx] instead of\nvp_dev->vqs[i], so the store index matches the lookup index\n(vq->index). Apply the fix to both the MSIX and INTX paths."}],"id":"CVE-2026-64457","lastModified":"2026-11-03T18:15:39.353","metrics":{},"published":"2026-07-25T10:17:30.830","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/075bc3c779e1ea7294afabdcb7e0a49536959b28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/41e6dc1a10036c9f47057033f19af7e52ec464b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/64a4c0befa77bcc01076aec9f93863ffd4ed06b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f7d380fb525c13bdd114369a1979c80c346e6abc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/virtio/virtio_pci_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"41e6dc1a10036c9f47057033f19af7e52ec464b6","status":"affected","version":"89a1c435aec269d109ed46ca7bbb10fa8edf7ace","versionType":"git"},{"lessThan":"075bc3c779e1ea7294afabdcb7e0a49536959b28","status":"affected","version":"89a1c435aec269d109ed46ca7bbb10fa8edf7ace","versionType":"git"},{"lessThan":"64a4c0befa77bcc01076aec9f93863ffd4ed06b7","status":"affected","version":"89a1c435aec269d109ed46ca7bbb10fa8edf7ace","versionType":"git"},{"lessThan":"f7d380fb525c13bdd114369a1979c80c346e6abc","status":"affected","version":"89a1c435aec269d109ed46ca7bbb10fa8edf7ace","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/virtio/virtio_pci_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7E74C98B-EDCD-4F22-835D-209CD8EB59B4","versionEndExcluding":"6.12.96","versionStartIncluding":"6.11.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*","matchCriteriaId":"4770BA57-3F3F-493B-8608-EC3B25254949","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*","matchCriteriaId":"4DEB27E7-30AA-45CC-8934-B89263EF3551","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*","matchCriteriaId":"E0005AEF-856E-47EB-BFE4-90C46899394D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*","matchCriteriaId":"39889A68-6D34-47A6-82FC-CD0BF23D6754","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*","matchCriteriaId":"B8383ABF-1457-401F-9B61-EE50F4C61F4F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*","matchCriteriaId":"B77A9280-37E6-49AD-B559-5B23A3B1DC3D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*","matchCriteriaId":"DE5298B3-04B4-4F3E-B186-01A58B5C75A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_pci: fix vq info pointer lookup via wrong index\n\nUnbinding a virtio balloon device:\n\n echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind\n\ntriggers a NULL pointer dereference. The dmesg says:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n [...]\n RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0\n Call Trace:\n \n vp_del_vqs+0x121/0x230\n remove_common+0x135/0x150\n virtballoon_remove+0xee/0x100\n virtio_dev_remove+0x3b/0x80\n device_release_driver_internal+0x187/0x2c0\n unbind_store+0xb9/0xe0\n kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180\n vfs_write+0x2a9/0x3b0\n ksys_write+0x5c/0xd0\n do_syscall_64+0x54/0x230\n entry_SYSCALL_64_after_hwframe+0x29/0x31\n [...]\n \n\nThe virtio_balloon device registers 5 queues (inflate, deflate, stats,\nfree_page, reporting) but only the first two are unconditional. The\nstats, free_page and reporting queues are each conditional on their\nrespective feature bits. When any of these features are absent, the\ncorresponding vqs_info entry has name == NULL, creating holes in the\narray.\n\nThe root cause is an indexing mismatch introduced when vq info storage\nwas changed to be passed as an argument. vp_find_vqs_msix() and\nvp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where 'i'\nis the caller's sparse array index. However, the virtqueue itself gets\nvq->index assigned from queue_idx, a dense index that skips NULL\nentries. When holes exist, 'i' and queue_idx diverge. Later,\nvp_del_vqs() looks up info via vp_dev->vqs[vq->index] using the dense\nindex into the sparsely-populated array, and hits NULL.\n\nFix this by storing info at vp_dev->vqs[queue_idx] instead of\nvp_dev->vqs[i], so the store index matches the lookup index\n(vq->index). Apply the fix to both the MSIX and INTX paths."}],"id":"CVE-2026-64457","lastModified":"2026-11-12T17:45:36.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-25T10:17:30.830","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/075bc3c779e1ea7294afabdcb7e0a49536959b28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/41e6dc1a10036c9f47057033f19af7e52ec464b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/64a4c0befa77bcc01076aec9f93863ffd4ed06b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7d380fb525c13bdd114369a1979c80c346e6abc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64458.json b/data/2026/CVE-2026-64458.json index 66e79ee12e..7e83fd271a 100644 --- a/data/2026/CVE-2026-64458.json +++ b/data/2026/CVE-2026-64458.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/damon.h","mm/damon/ops-common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"58321b4e6e4f0f412069ab27ccdd56292757343a","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"},{"lessThan":"74fef68d521150281e36cdaa20e9e1ee3e3aa146","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"},{"lessThan":"ef2ae10a4582bc92b7e944181bbd2f87f3d30f3a","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"},{"lessThan":"9c8f31eaae6140ecadec0c07320498a944556de2","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"},{"lessThan":"76e415ea88d20f022ed5cfcf78c50e156a267e91","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"},{"lessThan":"35d4a3cf70a855b50e53189ac2f8463e20a02046","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/damon.h","mm/damon/ops-common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/ops-common: handle extreme intervals in damon_hot_score()\n\nFix three issues in damon_hot_score() that comes from wrong handling of\nextreme (zero or too high) monitoring intervals user setup.\n\nWhen the user sets sampling interval zero, damon_max_nr_accesses(), which\nis called from damon_hot_score(), causes a divide-by-zero. Needless to\nsay, it is a problem.\n\nWhen the user sets the aggregation interval zero, the function returns\nzero. It is wrong, since the real maximum nr_acceses in the setup should\nbe one. Worse yet, it can cause another divide-by-zero from its caller,\ndamon_hot_score(), since it uses damon_max_nr_accesses() return value as a\ndenominator.\n\nWhen the user sets the aggregation interval very high, damon_hot_score()\ncould return a value out of [0, DAMOS_MAX_SCORE] range. Since the return\nvalue is used as an index to the regions_score_histogram array, which is\nDAMOS_MAX_SCORE+1 size, it causes out of bounds array access.\n\nThe issues can be relatively easily reproduced like below. The sysfs\nwrite permission is required, though.\n\n # ./damo start --damos_action lru_prio --damos_quota_space 100M \\\n --damos_quota_interval 1s\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 > contexts/0/monitoring_attrs/intervals/sample_us\n # echo 0 > contexts/0/monitoring_attrs/intervals/aggr_us\n # echo commit > state\n # dmesg\n [...]\n [ 131.329762] Oops: divide error: 0000 [#1] SMP NOPTI\n [...]\n [ 131.336089] RIP: 0010:damon_hot_score+0x27/0xd0\n [...]\n\nFix the divide-by-zero intervals problems by explicitly handling the zero\nintervals in damon_max_nr_accesses(). Fix the out-of-bound array access\nby applying [0, DAMOS_MAX_SCORE] bounds before returning from\ndamon_hot_score().\n\nThe issue was discovered [1] by Sashiko."}],"id":"CVE-2026-64458","lastModified":"2026-11-06T17:18:55.090","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64458","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:38:57.314626Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:30.943","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/35d4a3cf70a855b50e53189ac2f8463e20a02046"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/58321b4e6e4f0f412069ab27ccdd56292757343a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/74fef68d521150281e36cdaa20e9e1ee3e3aa146"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/76e415ea88d20f022ed5cfcf78c50e156a267e91"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9c8f31eaae6140ecadec0c07320498a944556de2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ef2ae10a4582bc92b7e944181bbd2f87f3d30f3a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/damon.h","mm/damon/ops-common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"58321b4e6e4f0f412069ab27ccdd56292757343a","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"},{"lessThan":"74fef68d521150281e36cdaa20e9e1ee3e3aa146","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"},{"lessThan":"ef2ae10a4582bc92b7e944181bbd2f87f3d30f3a","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"},{"lessThan":"9c8f31eaae6140ecadec0c07320498a944556de2","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"},{"lessThan":"76e415ea88d20f022ed5cfcf78c50e156a267e91","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"},{"lessThan":"35d4a3cf70a855b50e53189ac2f8463e20a02046","status":"affected","version":"198f0f4c58b9f481e4e51c8c70a6ab9852bbab7f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/damon.h","mm/damon/ops-common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/ops-common: handle extreme intervals in damon_hot_score()\n\nFix three issues in damon_hot_score() that comes from wrong handling of\nextreme (zero or too high) monitoring intervals user setup.\n\nWhen the user sets sampling interval zero, damon_max_nr_accesses(), which\nis called from damon_hot_score(), causes a divide-by-zero. Needless to\nsay, it is a problem.\n\nWhen the user sets the aggregation interval zero, the function returns\nzero. It is wrong, since the real maximum nr_acceses in the setup should\nbe one. Worse yet, it can cause another divide-by-zero from its caller,\ndamon_hot_score(), since it uses damon_max_nr_accesses() return value as a\ndenominator.\n\nWhen the user sets the aggregation interval very high, damon_hot_score()\ncould return a value out of [0, DAMOS_MAX_SCORE] range. Since the return\nvalue is used as an index to the regions_score_histogram array, which is\nDAMOS_MAX_SCORE+1 size, it causes out of bounds array access.\n\nThe issues can be relatively easily reproduced like below. The sysfs\nwrite permission is required, though.\n\n # ./damo start --damos_action lru_prio --damos_quota_space 100M \\\n --damos_quota_interval 1s\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 > contexts/0/monitoring_attrs/intervals/sample_us\n # echo 0 > contexts/0/monitoring_attrs/intervals/aggr_us\n # echo commit > state\n # dmesg\n [...]\n [ 131.329762] Oops: divide error: 0000 [#1] SMP NOPTI\n [...]\n [ 131.336089] RIP: 0010:damon_hot_score+0x27/0xd0\n [...]\n\nFix the divide-by-zero intervals problems by explicitly handling the zero\nintervals in damon_max_nr_accesses(). Fix the out-of-bound array access\nby applying [0, DAMOS_MAX_SCORE] bounds before returning from\ndamon_hot_score().\n\nThe issue was discovered [1] by Sashiko."}],"id":"CVE-2026-64458","lastModified":"2026-11-12T17:46:21.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64458","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:38:57.314626Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:30.943","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/35d4a3cf70a855b50e53189ac2f8463e20a02046"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/58321b4e6e4f0f412069ab27ccdd56292757343a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/74fef68d521150281e36cdaa20e9e1ee3e3aa146"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76e415ea88d20f022ed5cfcf78c50e156a267e91"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c8f31eaae6140ecadec0c07320498a944556de2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef2ae10a4582bc92b7e944181bbd2f87f3d30f3a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64460.json b/data/2026/CVE-2026-64460.json index 55146e8378..c5e68647b5 100644 --- a/data/2026/CVE-2026-64460.json +++ b/data/2026/CVE-2026-64460.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/iov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b77524621250407386f44c6eea7e5e4619ada1ce","status":"affected","version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","versionType":"git"},{"lessThan":"55fd485e66d0ad5c762c23dba1461fe9c741cd96","status":"affected","version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","versionType":"git"},{"lessThan":"f34f1712229d71ce4286440fef12526fd4590b37","status":"affected","version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/iov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/IOV: Skip VF Resizable BAR restore on read error\n\nsriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register\nto decide how many VF BARs to restore (nbars) and which VF BAR each\niteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[],\nwhich has only PCI_SRIOV_NUM_BARS (6) entries.\n\nWhen a device does not respond, config reads typically return\nPCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx\nboth evaluate to 7. The barsz[] access then goes out of bounds. UBSAN\nreports this as:\n\n UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]'\n\nObserved on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding\nduring a failed GC6 power state exit. The subsequent pci_restore_state()\ninvoked sriov_restore_vf_rebar_state() while config reads returned\n0xffffffff, triggering the splat.\n\nBail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE.\nNo further VF BARs are touched, which is safe because a config read that\nreturns PCI_ERROR_RESPONSE indicates the device is unreachable and\nrestoration is pointless. This mirrors the guard in\npci_restore_rebar_state()."}],"id":"CVE-2026-64460","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":1.1,"impactScore":5.3,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:12.033503Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:31.193","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/55fd485e66d0ad5c762c23dba1461fe9c741cd96"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b77524621250407386f44c6eea7e5e4619ada1ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f34f1712229d71ce4286440fef12526fd4590b37"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/iov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b77524621250407386f44c6eea7e5e4619ada1ce","status":"affected","version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","versionType":"git"},{"lessThan":"55fd485e66d0ad5c762c23dba1461fe9c741cd96","status":"affected","version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","versionType":"git"},{"lessThan":"f34f1712229d71ce4286440fef12526fd4590b37","status":"affected","version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/iov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E1B75939-A033-4965-9E4D-6588E462C6DF","versionEndExcluding":"6.18.39","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/IOV: Skip VF Resizable BAR restore on read error\n\nsriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register\nto decide how many VF BARs to restore (nbars) and which VF BAR each\niteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[],\nwhich has only PCI_SRIOV_NUM_BARS (6) entries.\n\nWhen a device does not respond, config reads typically return\nPCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx\nboth evaluate to 7. The barsz[] access then goes out of bounds. UBSAN\nreports this as:\n\n UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]'\n\nObserved on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding\nduring a failed GC6 power state exit. The subsequent pci_restore_state()\ninvoked sriov_restore_vf_rebar_state() while config reads returned\n0xffffffff, triggering the splat.\n\nBail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE.\nNo further VF BARs are touched, which is safe because a config read that\nreturns PCI_ERROR_RESPONSE indicates the device is unreachable and\nrestoration is pointless. This mirrors the guard in\npci_restore_rebar_state()."}],"id":"CVE-2026-64460","lastModified":"2026-11-12T19:40:07.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":1.1,"impactScore":5.3,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:12.033503Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:31.193","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/55fd485e66d0ad5c762c23dba1461fe9c741cd96"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b77524621250407386f44c6eea7e5e4619ada1ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f34f1712229d71ce4286440fef12526fd4590b37"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64461.json b/data/2026/CVE-2026-64461.json index 4f095cb0f5..9afcf19810 100644 --- a/data/2026/CVE-2026-64461.json +++ b/data/2026/CVE-2026-64461.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/controller/pcie-mediatek.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e23da72ef202654a7d5269885c4fa39a8404db76","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"ec7c05eed47d8b15c45380aee7ca168a82e15035","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"1fbe8972a39548a633d06d7b03a01b7b119a2c12","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"fe8c701a53c2816cd82301f66c671d952003c1b0","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"ce52e494a7555bdae1d990a2654fd7547ef6d986","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"6e6a529d6f779413379b4404c9ef6a36c0337225","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"f865a57896bd92d7662eb2818d8f48872e2cbbc7","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/controller/pcie-mediatek.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: mediatek: Fix IRQ domain leak when port fails to enable\n\nWhen mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port\nfrom pcie->ports and frees the port structure. However, the IRQ domains set\nup earlier by mtk_pcie_init_irq_domain() are never freed.\n\nFix this by refactoring mtk_pcie_irq_teardown() into a per-port helper,\nmtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when\nmtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in\nthe probe error path (during resume, child devices may have active MSI\nmappings and the NOIRQ context prohibits sleeping locks),\nmtk_pcie_enable_port() is changed to return an error code so callers can\ndistinguish the two paths and act accordingly.\n\nThis issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC\nsupport series."}],"id":"CVE-2026-64461","lastModified":"2026-11-06T17:18:55.260","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:39:04.662554Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:31.293","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1fbe8972a39548a633d06d7b03a01b7b119a2c12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6e6a529d6f779413379b4404c9ef6a36c0337225"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ce52e494a7555bdae1d990a2654fd7547ef6d986"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e23da72ef202654a7d5269885c4fa39a8404db76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ec7c05eed47d8b15c45380aee7ca168a82e15035"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f865a57896bd92d7662eb2818d8f48872e2cbbc7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fe8c701a53c2816cd82301f66c671d952003c1b0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/controller/pcie-mediatek.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e23da72ef202654a7d5269885c4fa39a8404db76","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"ec7c05eed47d8b15c45380aee7ca168a82e15035","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"1fbe8972a39548a633d06d7b03a01b7b119a2c12","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"fe8c701a53c2816cd82301f66c671d952003c1b0","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"ce52e494a7555bdae1d990a2654fd7547ef6d986","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"6e6a529d6f779413379b4404c9ef6a36c0337225","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"},{"lessThan":"f865a57896bd92d7662eb2818d8f48872e2cbbc7","status":"affected","version":"b099631df160ec608cd6147f4d20a8042567a5b8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/controller/pcie-mediatek.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"410ED1EA-21C4-4DC0-BF7D-15DFA726FA5D","versionEndExcluding":"5.10.261","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: mediatek: Fix IRQ domain leak when port fails to enable\n\nWhen mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port\nfrom pcie->ports and frees the port structure. However, the IRQ domains set\nup earlier by mtk_pcie_init_irq_domain() are never freed.\n\nFix this by refactoring mtk_pcie_irq_teardown() into a per-port helper,\nmtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when\nmtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in\nthe probe error path (during resume, child devices may have active MSI\nmappings and the NOIRQ context prohibits sleeping locks),\nmtk_pcie_enable_port() is changed to return an error code so callers can\ndistinguish the two paths and act accordingly.\n\nThis issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC\nsupport series."}],"id":"CVE-2026-64461","lastModified":"2026-11-12T18:06:11.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:39:04.662554Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:31.293","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1fbe8972a39548a633d06d7b03a01b7b119a2c12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e6a529d6f779413379b4404c9ef6a36c0337225"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ce52e494a7555bdae1d990a2654fd7547ef6d986"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e23da72ef202654a7d5269885c4fa39a8404db76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec7c05eed47d8b15c45380aee7ca168a82e15035"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f865a57896bd92d7662eb2818d8f48872e2cbbc7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fe8c701a53c2816cd82301f66c671d952003c1b0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64463.json b/data/2026/CVE-2026-64463.json index fb53bada67..ff65cb6020 100644 --- a/data/2026/CVE-2026-64463.json +++ b/data/2026/CVE-2026-64463.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/typec/tcpm/tcpci_rt1711h.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"388f5354158fc038214b73baad43a723385fea1e","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"lessThan":"ce2e36e8759dfbfe546723810c306f42f484866d","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"lessThan":"94b1abf1af94aa5a355e9f03675e07bccfc41c4b","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"lessThan":"e5406c8fb71cd2f89a46300a746f6e7972e621e8","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"lessThan":"569f18a83eed0b0be4615f0c7bed40fb5c50e2e6","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"lessThan":"e8da46d99d3710106e7c44db14566bf9b57386b5","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"status":"affected","version":"4309ab96ab744703871e35d829177dd9347bf643","versionType":"git"},{"status":"affected","version":"895ec8c86e13f85b119c71d5f95491b48867955e","versionType":"git"},{"status":"affected","version":"745dcedb896a740825160228f98dbb5725a49f85","versionType":"git"},{"lessThan":"4.20","status":"affected","version":"4.19.131","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.50","versionType":"semver"},{"lessThan":"5.8","status":"affected","version":"5.7.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/typec/tcpm/tcpci_rt1711h.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpci_rt1711h: unregister TCPCI port with devres\n\nrt1711h_probe() registers the TCPCI port before requesting the interrupt\nand enabling alert interrupts. If either of those later steps fails, the\nprobe function returns without unregistering the TCPCI port. The explicit\nunregister currently only happens from the remove callback.\n\nRegister a devres action immediately after tcpci_register_port() succeeds,\nso tcpci_unregister_port() runs on later probe failures and on driver\ndetach. Drop the remove callback to avoid unregistering the same port\ntwice.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."}],"id":"CVE-2026-64463","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64463","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:14.529944Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:31.543","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/388f5354158fc038214b73baad43a723385fea1e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/569f18a83eed0b0be4615f0c7bed40fb5c50e2e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/94b1abf1af94aa5a355e9f03675e07bccfc41c4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ce2e36e8759dfbfe546723810c306f42f484866d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e5406c8fb71cd2f89a46300a746f6e7972e621e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e8da46d99d3710106e7c44db14566bf9b57386b5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/typec/tcpm/tcpci_rt1711h.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"388f5354158fc038214b73baad43a723385fea1e","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"lessThan":"ce2e36e8759dfbfe546723810c306f42f484866d","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"lessThan":"94b1abf1af94aa5a355e9f03675e07bccfc41c4b","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"lessThan":"e5406c8fb71cd2f89a46300a746f6e7972e621e8","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"lessThan":"569f18a83eed0b0be4615f0c7bed40fb5c50e2e6","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"lessThan":"e8da46d99d3710106e7c44db14566bf9b57386b5","status":"affected","version":"302c570bf36e997d55ad0d60628a2feec76954a4","versionType":"git"},{"status":"affected","version":"4309ab96ab744703871e35d829177dd9347bf643","versionType":"git"},{"status":"affected","version":"895ec8c86e13f85b119c71d5f95491b48867955e","versionType":"git"},{"status":"affected","version":"745dcedb896a740825160228f98dbb5725a49f85","versionType":"git"},{"lessThan":"4.20","status":"affected","version":"4.19.131","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.50","versionType":"semver"},{"lessThan":"5.8","status":"affected","version":"5.7.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/typec/tcpm/tcpci_rt1711h.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AF565A16-C42C-49D8-8A16-1F259D16CA71","versionEndExcluding":"4.20","versionStartIncluding":"4.19.131","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"27AD1E00-91B8-4BCF-898E-23E059585706","versionEndExcluding":"5.5","versionStartIncluding":"5.4.50","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D7931AB8-4CD8-4A49-94BC-25814184B707","versionEndExcluding":"5.8","versionStartIncluding":"5.7.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9C130E65-6C16-49DE-B270-2629372DD193","versionEndExcluding":"6.1.191","versionStartIncluding":"5.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:-:*:*:*:*:*:*","matchCriteriaId":"0E2DC66F-4A95-475F-B8B6-191DEC1E7EF6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:rc3:*:*:*:*:*:*","matchCriteriaId":"CAF48A39-2B39-4924-84DA-BBB76CAE8A33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:rc4:*:*:*:*:*:*","matchCriteriaId":"B0A2B901-0516-4975-8C52-59B7E289A517","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:rc5:*:*:*:*:*:*","matchCriteriaId":"5F813669-CB80-4A17-9141-F3A4FA98CA13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:rc6:*:*:*:*:*:*","matchCriteriaId":"69E12239-342D-43B2-93F0-2760623AFEEF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:rc7:*:*:*:*:*:*","matchCriteriaId":"CA1501B4-945A-45C2-8E7C-65085BF91C76","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpci_rt1711h: unregister TCPCI port with devres\n\nrt1711h_probe() registers the TCPCI port before requesting the interrupt\nand enabling alert interrupts. If either of those later steps fails, the\nprobe function returns without unregistering the TCPCI port. The explicit\nunregister currently only happens from the remove callback.\n\nRegister a devres action immediately after tcpci_register_port() succeeds,\nso tcpci_unregister_port() runs on later probe failures and on driver\ndetach. Drop the remove callback to avoid unregistering the same port\ntwice.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."}],"id":"CVE-2026-64463","lastModified":"2026-11-12T20:34:20.143","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64463","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:14.529944Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:31.543","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/388f5354158fc038214b73baad43a723385fea1e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/569f18a83eed0b0be4615f0c7bed40fb5c50e2e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/94b1abf1af94aa5a355e9f03675e07bccfc41c4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ce2e36e8759dfbfe546723810c306f42f484866d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e5406c8fb71cd2f89a46300a746f6e7972e621e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e8da46d99d3710106e7c44db14566bf9b57386b5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64464.json b/data/2026/CVE-2026-64464.json index 3f2620dfb8..42c6f13265 100644 --- a/data/2026/CVE-2026-64464.json +++ b/data/2026/CVE-2026-64464.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/host/xhci-sideband.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"99d00a9e35e311a91d258029d5bb584377296c34","status":"affected","version":"de66754e9f8029f8ae955a588959b99cab56b506","versionType":"git"},{"lessThan":"a3eaf82ff842d6ca95937ea584417e04828235a6","status":"affected","version":"de66754e9f8029f8ae955a588959b99cab56b506","versionType":"git"},{"lessThan":"49f6e3c3ef19f04f6657ed8dce550e36c763abb8","status":"affected","version":"de66754e9f8029f8ae955a588959b99cab56b506","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/host/xhci-sideband.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: sideband: fix ring sg table pages leak\n\nxhci_ring_to_sgtable() allocates a temporary pages array and\nuses it to build the returned sg_table with\nsg_alloc_table_from_pages().\n\nThe error paths free the pages array, but the success path\nreturns the sg_table without freeing it. This leaks the temporary\narray every time a sideband client gets an endpoint or event ring\nbuffer.\n\nFree the pages array after sg_alloc_table_from_pages() succeeds.\nThe returned sg_table has its own scatterlist entries and does not\ndepend on the temporary array after construction."}],"id":"CVE-2026-64464","lastModified":"2026-11-03T18:15:39.353","metrics":{},"published":"2026-07-25T10:17:31.660","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/49f6e3c3ef19f04f6657ed8dce550e36c763abb8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/99d00a9e35e311a91d258029d5bb584377296c34"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a3eaf82ff842d6ca95937ea584417e04828235a6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/host/xhci-sideband.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"99d00a9e35e311a91d258029d5bb584377296c34","status":"affected","version":"de66754e9f8029f8ae955a588959b99cab56b506","versionType":"git"},{"lessThan":"a3eaf82ff842d6ca95937ea584417e04828235a6","status":"affected","version":"de66754e9f8029f8ae955a588959b99cab56b506","versionType":"git"},{"lessThan":"49f6e3c3ef19f04f6657ed8dce550e36c763abb8","status":"affected","version":"de66754e9f8029f8ae955a588959b99cab56b506","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/host/xhci-sideband.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FFBD7467-7FB0-4538-9CC0-98199E9EC402","versionEndExcluding":"6.18.39","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: sideband: fix ring sg table pages leak\n\nxhci_ring_to_sgtable() allocates a temporary pages array and\nuses it to build the returned sg_table with\nsg_alloc_table_from_pages().\n\nThe error paths free the pages array, but the success path\nreturns the sg_table without freeing it. This leaks the temporary\narray every time a sideband client gets an endpoint or event ring\nbuffer.\n\nFree the pages array after sg_alloc_table_from_pages() succeeds.\nThe returned sg_table has its own scatterlist entries and does not\ndepend on the temporary array after construction."}],"id":"CVE-2026-64464","lastModified":"2026-11-12T17:51:02.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-25T10:17:31.660","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49f6e3c3ef19f04f6657ed8dce550e36c763abb8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/99d00a9e35e311a91d258029d5bb584377296c34"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3eaf82ff842d6ca95937ea584417e04828235a6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64465.json b/data/2026/CVE-2026-64465.json index 2a10cd0ab4..4f56f8fd68 100644 --- a/data/2026/CVE-2026-64465.json +++ b/data/2026/CVE-2026-64465.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/host/xhci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e623e4a203f56d5c57519a9a3cb29600551534ad","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"d107eb316144c5fb958486e7fe604cd7f1b35cda","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"1e45aa722c4ce5663e987102aac18c8ad6a83fdd","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"10666ac9c552990204e791af653abf8e9d9ff619","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"f7b022ae07685e7526fc39f387ce65b5d309dd3b","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"f90586129cf9e1fbdb718ef602eea3f15dc1c31c","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"93cd037da94fcb93183bfb2457e3a56d3eb4c8f4","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"42c37c4b75d38b51d84f31a8e29427f5e06a7c2a","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/host/xhci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.35"},{"lessThan":"2.6.35","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix sleep in atomic context in xhci_free_streams()\n\nWhen a USB device with active stream endpoints is disconnected,\nxhci_free_streams() is called from the hub_event workqueue to\nfree the stream resources. It calls xhci_free_stream_info()\nwhile holding xhci->lock with irqs disabled.\n\nxhci_free_stream_info() invokes xhci_free_stream_ctx(), which\ncalls dma_free_coherent() for large stream context arrays.\n\ndma_free_coherent() can sleep (e.g. via vunmap), triggering\na BUG when called from atomic context.\n\nCall trace:\n dma_free_attrs+0x174/0x220\n xhci_free_stream_info+0xd0/0x11c\n xhci_free_streams+0x278/0x37c\n usb_free_streams+0x98/0xc0\n usb_unbind_interface+0x1b8/0x2f8\n device_release_driver_internal+0x1d4/0x2cc\n device_release_driver+0x18/0x28\n bus_remove_device+0x160/0x1a4\n device_del+0x1ec/0x350\n usb_disable_device+0x98/0x214\n usb_disconnect+0xf0/0x35c\n hub_event+0xab4/0x19ec\n process_one_work+0x278/0x63c\n\nFix this by saving the stream_info pointers and clearing the\nep references under the lock, then calling xhci_free_stream_info()\noutside the lock where sleeping is allowed."}],"id":"CVE-2026-64465","lastModified":"2026-11-06T17:18:55.440","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64465","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:39:09.199017Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:31.763","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/10666ac9c552990204e791af653abf8e9d9ff619"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1e45aa722c4ce5663e987102aac18c8ad6a83fdd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/42c37c4b75d38b51d84f31a8e29427f5e06a7c2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/93cd037da94fcb93183bfb2457e3a56d3eb4c8f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d107eb316144c5fb958486e7fe604cd7f1b35cda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e623e4a203f56d5c57519a9a3cb29600551534ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f7b022ae07685e7526fc39f387ce65b5d309dd3b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f90586129cf9e1fbdb718ef602eea3f15dc1c31c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/host/xhci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e623e4a203f56d5c57519a9a3cb29600551534ad","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"d107eb316144c5fb958486e7fe604cd7f1b35cda","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"1e45aa722c4ce5663e987102aac18c8ad6a83fdd","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"10666ac9c552990204e791af653abf8e9d9ff619","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"f7b022ae07685e7526fc39f387ce65b5d309dd3b","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"f90586129cf9e1fbdb718ef602eea3f15dc1c31c","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"93cd037da94fcb93183bfb2457e3a56d3eb4c8f4","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"},{"lessThan":"42c37c4b75d38b51d84f31a8e29427f5e06a7c2a","status":"affected","version":"8df75f42f8e67e2851cdcf6da91640fb881defd1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/host/xhci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.35"},{"lessThan":"2.6.35","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8C1B5857-DB9D-45AB-8716-77FE8FA1B602","versionEndExcluding":"5.10.261","versionStartIncluding":"2.6.35","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix sleep in atomic context in xhci_free_streams()\n\nWhen a USB device with active stream endpoints is disconnected,\nxhci_free_streams() is called from the hub_event workqueue to\nfree the stream resources. It calls xhci_free_stream_info()\nwhile holding xhci->lock with irqs disabled.\n\nxhci_free_stream_info() invokes xhci_free_stream_ctx(), which\ncalls dma_free_coherent() for large stream context arrays.\n\ndma_free_coherent() can sleep (e.g. via vunmap), triggering\na BUG when called from atomic context.\n\nCall trace:\n dma_free_attrs+0x174/0x220\n xhci_free_stream_info+0xd0/0x11c\n xhci_free_streams+0x278/0x37c\n usb_free_streams+0x98/0xc0\n usb_unbind_interface+0x1b8/0x2f8\n device_release_driver_internal+0x1d4/0x2cc\n device_release_driver+0x18/0x28\n bus_remove_device+0x160/0x1a4\n device_del+0x1ec/0x350\n usb_disable_device+0x98/0x214\n usb_disconnect+0xf0/0x35c\n hub_event+0xab4/0x19ec\n process_one_work+0x278/0x63c\n\nFix this by saving the stream_info pointers and clearing the\nep references under the lock, then calling xhci_free_stream_info()\noutside the lock where sleeping is allowed."}],"id":"CVE-2026-64465","lastModified":"2026-11-12T17:51:23.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64465","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:39:09.199017Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:31.763","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10666ac9c552990204e791af653abf8e9d9ff619"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1e45aa722c4ce5663e987102aac18c8ad6a83fdd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42c37c4b75d38b51d84f31a8e29427f5e06a7c2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93cd037da94fcb93183bfb2457e3a56d3eb4c8f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d107eb316144c5fb958486e7fe604cd7f1b35cda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e623e4a203f56d5c57519a9a3cb29600551534ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7b022ae07685e7526fc39f387ce65b5d309dd3b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f90586129cf9e1fbdb718ef602eea3f15dc1c31c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64466.json b/data/2026/CVE-2026-64466.json index 72028f45d5..b87b7797eb 100644 --- a/data/2026/CVE-2026-64466.json +++ b/data/2026/CVE-2026-64466.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/android/binder/freeze.rs","drivers/android/binder/node.rs","drivers/android/binder/process.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"91b27f8172cdbf265240104772fd042a461a7767","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"},{"lessThan":"0644da3621ddd8e146280675a2a31d1e06634a1d","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"},{"lessThan":"bc4a9828897871ff3e5a1f8a1d346decbf4ee95e","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/android/binder/freeze.rs","drivers/android/binder/node.rs","drivers/android/binder/process.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: clear freeze listener on node removal\n\nGenerally userspace is supposed to explicitly clear freeze listeners\nbefore they drop the refcount on the node ref to zero, but there's\nnothing forcing that. Currently, in this scenario the freeze listener\nremains in the freeze_listeners rbtree and in the remote node's freeze\nlistener list, even though the ref for which the listener is registered\nis gone. This could potentially lead to a memory leak due to a refcount\ncycle. Thus, remove the freeze listener in this scenario."}],"id":"CVE-2026-64466","lastModified":"2026-11-03T18:15:39.353","metrics":{},"published":"2026-07-25T10:17:31.893","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0644da3621ddd8e146280675a2a31d1e06634a1d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/91b27f8172cdbf265240104772fd042a461a7767"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bc4a9828897871ff3e5a1f8a1d346decbf4ee95e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/android/binder/freeze.rs","drivers/android/binder/node.rs","drivers/android/binder/process.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"91b27f8172cdbf265240104772fd042a461a7767","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"},{"lessThan":"0644da3621ddd8e146280675a2a31d1e06634a1d","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"},{"lessThan":"bc4a9828897871ff3e5a1f8a1d346decbf4ee95e","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/android/binder/freeze.rs","drivers/android/binder/node.rs","drivers/android/binder/process.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CA2CE3BD-0548-4984-8C39-F3D3DF4D64E1","versionEndExcluding":"6.18.39","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: clear freeze listener on node removal\n\nGenerally userspace is supposed to explicitly clear freeze listeners\nbefore they drop the refcount on the node ref to zero, but there's\nnothing forcing that. Currently, in this scenario the freeze listener\nremains in the freeze_listeners rbtree and in the remote node's freeze\nlistener list, even though the ref for which the listener is registered\nis gone. This could potentially lead to a memory leak due to a refcount\ncycle. Thus, remove the freeze listener in this scenario."}],"id":"CVE-2026-64466","lastModified":"2026-11-12T17:51:39.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-25T10:17:31.893","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0644da3621ddd8e146280675a2a31d1e06634a1d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/91b27f8172cdbf265240104772fd042a461a7767"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bc4a9828897871ff3e5a1f8a1d346decbf4ee95e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64467.json b/data/2026/CVE-2026-64467.json index a752f09055..bba9bfba33 100644 --- a/data/2026/CVE-2026-64467.json +++ b/data/2026/CVE-2026-64467.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/android/binder/allocation.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"89b8cc948dce661af87527623b3a41cdd115e2f9","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"},{"lessThan":"74920b1b4e474ba7a4de4323c0458deec49d210b","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"},{"lessThan":"803c8a9502e9b97cd6ae937618ef4a8fd6274343","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/android/binder/allocation.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: use a u64 stride when cleaning up the offsets array\n\nAllocation's Drop walks the offsets array (binder_size_t = u64 entries),\ncleaning up the objects, but it used usize instead of u64 for both the\nstride and the per-entry read.\n\nOn 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels\nit walks the 8-byte entries in 4-byte steps, iterating an N-entry array\n2N times, and reads the always-zero high word as offset 0, cleaning up\nthe object at offset 0 N extra times. As a result the referenced node or\nhandle ends up with a lower reference count than it actually has (a\nrefcount over-decrement), and binder's reference accounting is corrupted;\nfor example, the owner can be notified of a strong reference release\n(BR_RELEASE) even though references still remain.\n\nChange the stride to u64, and read each entry as a u64, narrowing it to\nusize with try_into().\n\nOn 32-bit ARM, when this over-decrement would drive a count below zero,\nthe driver's existing refcount guard refuses it and fires:\n\n rust_binder: Failure: refcount underflow!"}],"id":"CVE-2026-64467","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-07-25T10:17:32.003","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/android/binder/allocation.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"89b8cc948dce661af87527623b3a41cdd115e2f9","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"},{"lessThan":"74920b1b4e474ba7a4de4323c0458deec49d210b","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"},{"lessThan":"803c8a9502e9b97cd6ae937618ef4a8fd6274343","status":"affected","version":"eafedbc7c050c44744fbdf80bdf3315e860b7513","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/android/binder/allocation.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CA2CE3BD-0548-4984-8C39-F3D3DF4D64E1","versionEndExcluding":"6.18.39","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: use a u64 stride when cleaning up the offsets array\n\nAllocation's Drop walks the offsets array (binder_size_t = u64 entries),\ncleaning up the objects, but it used usize instead of u64 for both the\nstride and the per-entry read.\n\nOn 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels\nit walks the 8-byte entries in 4-byte steps, iterating an N-entry array\n2N times, and reads the always-zero high word as offset 0, cleaning up\nthe object at offset 0 N extra times. As a result the referenced node or\nhandle ends up with a lower reference count than it actually has (a\nrefcount over-decrement), and binder's reference accounting is corrupted;\nfor example, the owner can be notified of a strong reference release\n(BR_RELEASE) even though references still remain.\n\nChange the stride to u64, and read each entry as a u64, narrowing it to\nusize with try_into().\n\nOn 32-bit ARM, when this over-decrement would drive a count below zero,\nthe driver's existing refcount guard refuses it and fires:\n\n rust_binder: Failure: refcount underflow!"}],"id":"CVE-2026-64467","lastModified":"2026-11-12T18:01:18.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-07-25T10:17:32.003","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64468.json b/data/2026/CVE-2026-64468.json index 2070513260..1bc8dd23d5 100644 --- a/data/2026/CVE-2026-64468.json +++ b/data/2026/CVE-2026-64468.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5602a43f251c3d75312df91a422675fc00ca3dce","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"0be901ab1dcc4af59b88f2e324493bb283850167","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"48aeda9f8039e4a6971d1804578efde7f2c01eda","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"45df558c543bb5543bacc8065fd7c567740781e5","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"d45ef513eed1abebfec90c3cfb6ae50c2a4182db","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"328ccf32acb87e8bbb1fe2b065068c574e4db2bf","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"0f15f0f6ca5df566275ce517f257af2559528b41","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"f223d27a546c1e1f48d38fd67760e78f068fe8c4","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"status":"affected","version":"a4a3c070b8760f71c8311399fa9bfe67c8629bca","versionType":"git"},{"status":"affected","version":"22068d49d09d2b3890e19d7b2048a33340f992da","versionType":"git"},{"status":"affected","version":"0e3b977a8f1be01dcfa0baae68851b1f55f2a0a9","versionType":"git"},{"lessThan":"4.15","status":"affected","version":"4.14.136","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.64","versionType":"semver"},{"lessThan":"5.2","status":"affected","version":"5.1.15","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.2"},{"lessThan":"5.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_free_transaction()\n\nIn binder_free_transaction(), the t->to_proc is read under the t->lock.\nHowever, once the t->lock is dropped, the to_proc can die in parallel.\nThis leads to a use-after-free error when we attempt to acquire its\ninner lock right afterwards:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0\n Write of size 4 at addr ffff00001125da70 by task B/672\n\n CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT\n Hardware name: linux,dummy-virt (DT)\n Call trace:\n _raw_spin_lock+0xe4/0x1a0\n binder_free_transaction+0x8c/0x320\n binder_send_failed_reply+0x21c/0x2f8\n binder_thread_release+0x488/0x7e0\n binder_ioctl+0x12c0/0x29a0\n [...]\n\n Allocated by task 675:\n __kmalloc_cache_noprof+0x174/0x444\n binder_open+0x118/0xb70\n do_dentry_open+0x374/0x1040\n vfs_open+0x58/0x3bc\n [...]\n\n Freed by task 212:\n __kasan_slab_free+0x58/0x80\n kfree+0x1a0/0x4a4\n binder_proc_dec_tmpref+0x32c/0x5e0\n binder_deferred_func+0xc48/0x104c\n process_one_work+0x53c/0xbc0\n [...]\n ==================================================================\n\nTo prevent this, pin the target thread (t->to_thread) to guarantee the\ntarget process remains alive. Undelivered transactions without a target\nthread are already safe, as the target process can only be the current\ncontext in those paths."}],"id":"CVE-2026-64468","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-07-25T10:17:32.103","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0be901ab1dcc4af59b88f2e324493bb283850167"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0f15f0f6ca5df566275ce517f257af2559528b41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/328ccf32acb87e8bbb1fe2b065068c574e4db2bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/45df558c543bb5543bacc8065fd7c567740781e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/48aeda9f8039e4a6971d1804578efde7f2c01eda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5602a43f251c3d75312df91a422675fc00ca3dce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d45ef513eed1abebfec90c3cfb6ae50c2a4182db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f223d27a546c1e1f48d38fd67760e78f068fe8c4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5602a43f251c3d75312df91a422675fc00ca3dce","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"0be901ab1dcc4af59b88f2e324493bb283850167","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"48aeda9f8039e4a6971d1804578efde7f2c01eda","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"45df558c543bb5543bacc8065fd7c567740781e5","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"d45ef513eed1abebfec90c3cfb6ae50c2a4182db","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"328ccf32acb87e8bbb1fe2b065068c574e4db2bf","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"0f15f0f6ca5df566275ce517f257af2559528b41","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"lessThan":"f223d27a546c1e1f48d38fd67760e78f068fe8c4","status":"affected","version":"a370003cc301d4361bae20c9ef615f89bf8d1e8a","versionType":"git"},{"status":"affected","version":"a4a3c070b8760f71c8311399fa9bfe67c8629bca","versionType":"git"},{"status":"affected","version":"22068d49d09d2b3890e19d7b2048a33340f992da","versionType":"git"},{"status":"affected","version":"0e3b977a8f1be01dcfa0baae68851b1f55f2a0a9","versionType":"git"},{"lessThan":"4.15","status":"affected","version":"4.14.136","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.64","versionType":"semver"},{"lessThan":"5.2","status":"affected","version":"5.1.15","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.2"},{"lessThan":"5.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"91C47692-2547-4333-AD65-E82526CB2B77","versionEndExcluding":"4.15","versionStartIncluding":"4.14.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C27472C2-E584-440A-8119-3A96F573B75A","versionEndExcluding":"4.20","versionStartIncluding":"4.19.64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BE279492-FEE9-4AF0-AC17-1E682545ADEB","versionEndExcluding":"5.2","versionStartIncluding":"5.1.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5C8460DB-A8BF-43CA-AC64-CBBBBEAC10F5","versionEndExcluding":"5.10.261","versionStartIncluding":"5.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.2:-:*:*:*:*:*:*","matchCriteriaId":"76B232EC-BD47-422E-A130-E167DCA55D88","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.2:rc6:*:*:*:*:*:*","matchCriteriaId":"4C3DC01D-8A16-42EB-8B3D-D170507ABDF2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.2:rc7:*:*:*:*:*:*","matchCriteriaId":"5D0F8E59-A7FA-4BD7-89C3-4C4DCF11D8C5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_free_transaction()\n\nIn binder_free_transaction(), the t->to_proc is read under the t->lock.\nHowever, once the t->lock is dropped, the to_proc can die in parallel.\nThis leads to a use-after-free error when we attempt to acquire its\ninner lock right afterwards:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0\n Write of size 4 at addr ffff00001125da70 by task B/672\n\n CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT\n Hardware name: linux,dummy-virt (DT)\n Call trace:\n _raw_spin_lock+0xe4/0x1a0\n binder_free_transaction+0x8c/0x320\n binder_send_failed_reply+0x21c/0x2f8\n binder_thread_release+0x488/0x7e0\n binder_ioctl+0x12c0/0x29a0\n [...]\n\n Allocated by task 675:\n __kmalloc_cache_noprof+0x174/0x444\n binder_open+0x118/0xb70\n do_dentry_open+0x374/0x1040\n vfs_open+0x58/0x3bc\n [...]\n\n Freed by task 212:\n __kasan_slab_free+0x58/0x80\n kfree+0x1a0/0x4a4\n binder_proc_dec_tmpref+0x32c/0x5e0\n binder_deferred_func+0xc48/0x104c\n process_one_work+0x53c/0xbc0\n [...]\n ==================================================================\n\nTo prevent this, pin the target thread (t->to_thread) to guarantee the\ntarget process remains alive. Undelivered transactions without a target\nthread are already safe, as the target process can only be the current\ncontext in those paths."}],"id":"CVE-2026-64468","lastModified":"2026-11-12T18:02:32.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-07-25T10:17:32.103","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0be901ab1dcc4af59b88f2e324493bb283850167"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f15f0f6ca5df566275ce517f257af2559528b41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/328ccf32acb87e8bbb1fe2b065068c574e4db2bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45df558c543bb5543bacc8065fd7c567740781e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48aeda9f8039e4a6971d1804578efde7f2c01eda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5602a43f251c3d75312df91a422675fc00ca3dce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d45ef513eed1abebfec90c3cfb6ae50c2a4182db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f223d27a546c1e1f48d38fd67760e78f068fe8c4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64469.json b/data/2026/CVE-2026-64469.json index 9ea6d781d1..a06e28d3bb 100644 --- a/data/2026/CVE-2026-64469.json +++ b/data/2026/CVE-2026-64469.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"df1a17abba8d6fac5f965adcb8113ceace6e4949","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"38e1a71728e5795b670cc159c18e286a40aeebb4","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"faa070c7ad8ba25dcd0b12d7cdbb419e336f5391","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"e63032dc715026a96bcaa13d375a8e15c91caa84","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"ea02df466df60ecd758eb3b4df3f0cadc5c886ce","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"ef5439ba5b9ac93349f5df12ef88b42a0ce26340","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"114a116aaa5f0295376cdf12da743c5bce3b20ce","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_thread_release()\n\nWhen a thread exits, binder_thread_release() walks its transaction stack\nto clear the t->from and t->to_proc that correspond with the exiting\nthread. However, a process dying in parallel might attempt to kfree some\nof these transactions. And if one of them has no associated t->to_proc,\nthe t->to_proc->inner_lock will not be acquired.\n\nThis means that transaction accesses in binder_thread_release() after\nt->to_proc has been cleared might race with binder_free_transaction()\nand cause a use-after-free error as reported by KASAN:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798\n Write of size 8 at addr ffff000016627500 by task X/715\n\n CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT\n Hardware name: linux,dummy-virt (DT)\n Call trace:\n binder_thread_release+0x5d0/0x798\n binder_ioctl+0x12c0/0x299c\n [...]\n\n Allocated by task 717 on cpu 18 at 67.267803s:\n __kasan_kmalloc+0xa0/0xbc\n __kmalloc_cache_noprof+0x174/0x444\n binder_transaction+0x554/0x8150\n binder_thread_write+0xa30/0x4354\n binder_ioctl+0x20f0/0x299c\n [...]\n\n Freed by task 202 on cpu 18 at 90.416221s:\n __kasan_slab_free+0x58/0x80\n kfree+0x1a0/0x4a4\n binder_free_transaction+0x150/0x294\n binder_send_failed_reply+0x398/0x6d8\n binder_release_work+0x3e4/0x4ec\n binder_deferred_func+0xbd8/0x104c\n [...]\n ==================================================================\n\nIn order to avoid this, make sure that binder_free_transaction() reads\nthe t->to_proc under the transaction lock. This will serialize the\ntransaction release with the accesses in binder_thread_release(). Plus,\nit matches the documented locking rules for @to_proc."}],"id":"CVE-2026-64469","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-07-25T10:17:32.247","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/114a116aaa5f0295376cdf12da743c5bce3b20ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/38e1a71728e5795b670cc159c18e286a40aeebb4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/df1a17abba8d6fac5f965adcb8113ceace6e4949"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e63032dc715026a96bcaa13d375a8e15c91caa84"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ea02df466df60ecd758eb3b4df3f0cadc5c886ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ef5439ba5b9ac93349f5df12ef88b42a0ce26340"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/faa070c7ad8ba25dcd0b12d7cdbb419e336f5391"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"df1a17abba8d6fac5f965adcb8113ceace6e4949","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"38e1a71728e5795b670cc159c18e286a40aeebb4","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"faa070c7ad8ba25dcd0b12d7cdbb419e336f5391","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"e63032dc715026a96bcaa13d375a8e15c91caa84","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"ea02df466df60ecd758eb3b4df3f0cadc5c886ce","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"ef5439ba5b9ac93349f5df12ef88b42a0ce26340","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"},{"lessThan":"114a116aaa5f0295376cdf12da743c5bce3b20ce","status":"affected","version":"7a4408c6bd3eb1dafba67986259191be081e3efb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/android/binder.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"410ED1EA-21C4-4DC0-BF7D-15DFA726FA5D","versionEndExcluding":"5.10.261","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_thread_release()\n\nWhen a thread exits, binder_thread_release() walks its transaction stack\nto clear the t->from and t->to_proc that correspond with the exiting\nthread. However, a process dying in parallel might attempt to kfree some\nof these transactions. And if one of them has no associated t->to_proc,\nthe t->to_proc->inner_lock will not be acquired.\n\nThis means that transaction accesses in binder_thread_release() after\nt->to_proc has been cleared might race with binder_free_transaction()\nand cause a use-after-free error as reported by KASAN:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798\n Write of size 8 at addr ffff000016627500 by task X/715\n\n CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT\n Hardware name: linux,dummy-virt (DT)\n Call trace:\n binder_thread_release+0x5d0/0x798\n binder_ioctl+0x12c0/0x299c\n [...]\n\n Allocated by task 717 on cpu 18 at 67.267803s:\n __kasan_kmalloc+0xa0/0xbc\n __kmalloc_cache_noprof+0x174/0x444\n binder_transaction+0x554/0x8150\n binder_thread_write+0xa30/0x4354\n binder_ioctl+0x20f0/0x299c\n [...]\n\n Freed by task 202 on cpu 18 at 90.416221s:\n __kasan_slab_free+0x58/0x80\n kfree+0x1a0/0x4a4\n binder_free_transaction+0x150/0x294\n binder_send_failed_reply+0x398/0x6d8\n binder_release_work+0x3e4/0x4ec\n binder_deferred_func+0xbd8/0x104c\n [...]\n ==================================================================\n\nIn order to avoid this, make sure that binder_free_transaction() reads\nthe t->to_proc under the transaction lock. This will serialize the\ntransaction release with the accesses in binder_thread_release(). Plus,\nit matches the documented locking rules for @to_proc."}],"id":"CVE-2026-64469","lastModified":"2026-11-12T18:02:55.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-07-25T10:17:32.247","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/114a116aaa5f0295376cdf12da743c5bce3b20ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38e1a71728e5795b670cc159c18e286a40aeebb4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df1a17abba8d6fac5f965adcb8113ceace6e4949"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e63032dc715026a96bcaa13d375a8e15c91caa84"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea02df466df60ecd758eb3b4df3f0cadc5c886ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef5439ba5b9ac93349f5df12ef88b42a0ce26340"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/faa070c7ad8ba25dcd0b12d7cdbb419e336f5391"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64472.json b/data/2026/CVE-2026-64472.json index 23eca74698..af34577b9a 100644 --- a/data/2026/CVE-2026-64472.json +++ b/data/2026/CVE-2026-64472.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/pci/mlx5/cmd.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1dd99b8f4e143592e12e5a77e7b538bc698116cb","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"},{"lessThan":"f1db80a67da928a92ba460ede1be52d8941f46be","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"},{"lessThan":"399d806f998f7a25405fc1b97227e579aead24af","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"},{"lessThan":"7ed120b1a007bace57c461805519d70e1af44e59","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"},{"lessThan":"39d163627b51886492bf31f66cb02c94613d2287","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"},{"lessThan":"f2365a63b02ddea32e7db78b742c2503ec7b81f1","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/pci/mlx5/cmd.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/mlx5: Fix racy bitfields and tighten struct layout\n\nBitfield operations are not atomic, they use a read-modify-write\npattern, therefore we should be careful not to pack bitfields that\ncan be concurrently updated into the same storage unit.\n\nThis split takes a binary approach: flags that are only modified\npre/post open/close remain bitfields, flags modified from user\naction, including actions that reach across to another device (ex.\nreset) use dedicated storage units.\n\nNote mlx5_vhca_page_tracker.status is relocated to fill the alignment\nhole this split exposes.\n\nBitfield justifications:\n\n migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe\n chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe\n mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe\n\nDedicated storage units:\n\n mdev_detach: written in the VF attach/detach event notifier\n mlx5fv_vf_event() at runtime\n log_active: written in mlx5vf_start_page_tracker()/\n mlx5vf_stop_page_tracker() during runtime dirty tracking\n deferred_reset: written in mlx5vf_state_mutex_unlock()/\n mlx5vf_pci_aer_reset_done() during runtime reset handling\n is_err: set by tracker error handling and dirty-log polling at runtime\n object_changed: set by tracker event handling and cleared by dirty-log\n polling at runtime"}],"id":"CVE-2026-64472","lastModified":"2026-11-06T17:18:55.943","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64472","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:39:33.414588Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:32.630","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1dd99b8f4e143592e12e5a77e7b538bc698116cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/399d806f998f7a25405fc1b97227e579aead24af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/39d163627b51886492bf31f66cb02c94613d2287"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7ed120b1a007bace57c461805519d70e1af44e59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f1db80a67da928a92ba460ede1be52d8941f46be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f2365a63b02ddea32e7db78b742c2503ec7b81f1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/pci/mlx5/cmd.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1dd99b8f4e143592e12e5a77e7b538bc698116cb","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"},{"lessThan":"f1db80a67da928a92ba460ede1be52d8941f46be","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"},{"lessThan":"399d806f998f7a25405fc1b97227e579aead24af","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"},{"lessThan":"7ed120b1a007bace57c461805519d70e1af44e59","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"},{"lessThan":"39d163627b51886492bf31f66cb02c94613d2287","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"},{"lessThan":"f2365a63b02ddea32e7db78b742c2503ec7b81f1","status":"affected","version":"61a2f1460fd03285ea34c1a235f2f50f71e13a1f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/pci/mlx5/cmd.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CFE34378-E34A-4EB8-94FC-23E73A95EB5D","versionEndExcluding":"6.1.178","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/mlx5: Fix racy bitfields and tighten struct layout\n\nBitfield operations are not atomic, they use a read-modify-write\npattern, therefore we should be careful not to pack bitfields that\ncan be concurrently updated into the same storage unit.\n\nThis split takes a binary approach: flags that are only modified\npre/post open/close remain bitfields, flags modified from user\naction, including actions that reach across to another device (ex.\nreset) use dedicated storage units.\n\nNote mlx5_vhca_page_tracker.status is relocated to fill the alignment\nhole this split exposes.\n\nBitfield justifications:\n\n migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe\n chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe\n mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe\n\nDedicated storage units:\n\n mdev_detach: written in the VF attach/detach event notifier\n mlx5fv_vf_event() at runtime\n log_active: written in mlx5vf_start_page_tracker()/\n mlx5vf_stop_page_tracker() during runtime dirty tracking\n deferred_reset: written in mlx5vf_state_mutex_unlock()/\n mlx5vf_pci_aer_reset_done() during runtime reset handling\n is_err: set by tracker error handling and dirty-log polling at runtime\n object_changed: set by tracker event handling and cleared by dirty-log\n polling at runtime"}],"id":"CVE-2026-64472","lastModified":"2026-11-12T18:03:10.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64472","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:39:33.414588Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:32.630","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1dd99b8f4e143592e12e5a77e7b538bc698116cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/399d806f998f7a25405fc1b97227e579aead24af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39d163627b51886492bf31f66cb02c94613d2287"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ed120b1a007bace57c461805519d70e1af44e59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1db80a67da928a92ba460ede1be52d8941f46be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f2365a63b02ddea32e7db78b742c2503ec7b81f1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64473.json b/data/2026/CVE-2026-64473.json index 267032b3cf..0e9520b215 100644 --- a/data/2026/CVE-2026-64473.json +++ b/data/2026/CVE-2026-64473.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/debugfs.c","drivers/vfio/vfio_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6cc60b41d61657dc469893d14e8e55d160056ff1","status":"affected","version":"2202844e4468c7539dba0c0b06577c93735af952","versionType":"git"},{"lessThan":"a53109ffb6b5148e11a27fb7670355b92db12dd3","status":"affected","version":"2202844e4468c7539dba0c0b06577c93735af952","versionType":"git"},{"lessThan":"a5df401dc84f091e20b045560569f0736758fea7","status":"affected","version":"2202844e4468c7539dba0c0b06577c93735af952","versionType":"git"},{"lessThan":"dc7fe87de492ea7f33a72b78d26650b75bf37f4f","status":"affected","version":"2202844e4468c7539dba0c0b06577c93735af952","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/debugfs.c","drivers/vfio/vfio_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio: Remove device debugfs before releasing devres\n\nVFIO device debugfs files created with debugfs_create_devm_seqfile()\nstore a devres allocated debugfs_devm_entry as inode private data.\nvfio_unregister_group_dev() currently calls vfio_device_del() before\nvfio_device_debugfs_exit(), but device_del() releases devres. This can\nleave debugfs entries visible with stale inode private data while\nunregister waits for userspace references to drain.\n\nRemove the per-device debugfs tree before vfio_device_del(). The debugfs\nview is diagnostic only, so losing it at the start of unregister is\npreferable to preserving entries whose backing storage may already have\nbeen released.\n\nComplete the teardown by clearing the per-device debugfs root after\nremoval. This matches the global debugfs root cleanup and prevents\nfuture users from mistaking a removed dentry for a live debugfs tree\nduring the remainder of unregister."}],"id":"CVE-2026-64473","lastModified":"2026-11-03T18:15:39.353","metrics":{},"published":"2026-07-25T10:17:32.757","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6cc60b41d61657dc469893d14e8e55d160056ff1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a53109ffb6b5148e11a27fb7670355b92db12dd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a5df401dc84f091e20b045560569f0736758fea7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dc7fe87de492ea7f33a72b78d26650b75bf37f4f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/debugfs.c","drivers/vfio/vfio_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6cc60b41d61657dc469893d14e8e55d160056ff1","status":"affected","version":"2202844e4468c7539dba0c0b06577c93735af952","versionType":"git"},{"lessThan":"a53109ffb6b5148e11a27fb7670355b92db12dd3","status":"affected","version":"2202844e4468c7539dba0c0b06577c93735af952","versionType":"git"},{"lessThan":"a5df401dc84f091e20b045560569f0736758fea7","status":"affected","version":"2202844e4468c7539dba0c0b06577c93735af952","versionType":"git"},{"lessThan":"dc7fe87de492ea7f33a72b78d26650b75bf37f4f","status":"affected","version":"2202844e4468c7539dba0c0b06577c93735af952","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/debugfs.c","drivers/vfio/vfio_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E97CF8C4-8024-4996-ADD8-35BAE38BC68B","versionEndExcluding":"6.12.96","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio: Remove device debugfs before releasing devres\n\nVFIO device debugfs files created with debugfs_create_devm_seqfile()\nstore a devres allocated debugfs_devm_entry as inode private data.\nvfio_unregister_group_dev() currently calls vfio_device_del() before\nvfio_device_debugfs_exit(), but device_del() releases devres. This can\nleave debugfs entries visible with stale inode private data while\nunregister waits for userspace references to drain.\n\nRemove the per-device debugfs tree before vfio_device_del(). The debugfs\nview is diagnostic only, so losing it at the start of unregister is\npreferable to preserving entries whose backing storage may already have\nbeen released.\n\nComplete the teardown by clearing the per-device debugfs root after\nremoval. This matches the global debugfs root cleanup and prevents\nfuture users from mistaking a removed dentry for a live debugfs tree\nduring the remainder of unregister."}],"id":"CVE-2026-64473","lastModified":"2026-11-12T18:03:24.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-25T10:17:32.757","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6cc60b41d61657dc469893d14e8e55d160056ff1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a53109ffb6b5148e11a27fb7670355b92db12dd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a5df401dc84f091e20b045560569f0736758fea7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dc7fe87de492ea7f33a72b78d26650b75bf37f4f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64475.json b/data/2026/CVE-2026-64475.json index fa4335a540..9d8772fd5f 100644 --- a/data/2026/CVE-2026-64475.json +++ b/data/2026/CVE-2026-64475.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0f2a35a0c7ea7da347b814750eaa78adf3582381","status":"affected","version":"87856f9af04eaacf9848710625a4ffee1d020fa9","versionType":"git"},{"lessThan":"8d65decde9afd2bd78bcfffdc0df73b82a0b5509","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"ef4c38d30b3744e89eb5048218904bb629ea8d47","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"9e0a3f642e607848669235f5069f35640abbfc88","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"42d758a09d2c46c42357ecde9a5492f015bde2e5","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"52adb2dff7ce3d8430e2bdc5988b618a430def85","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"278a5659c391fe5afe5f9ce1bad1fd24e90144f1","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"daedde7f024ecf88bc8e832ed40cf2c795f0796a","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"status":"affected","version":"d62dccb417cf972c978bf3c68a7d5e846bcf953e","versionType":"git"},{"status":"affected","version":"6694b8daffac5a8661071f085608afc78f7acd08","versionType":"git"},{"lessThan":"5.10.261","status":"affected","version":"5.10.37","versionType":"semver"},{"lessThan":"5.12","status":"affected","version":"5.11.21","versionType":"semver"},{"lessThan":"5.13","status":"affected","version":"5.12.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Release the VGA arbiter client on register_device() failure\n\nThe re-order in the Fixes commit below displaced vfio_pci_vga_init() as\nthe last failure point of what is now vfio_pci_core_register_device()\nwithout introducing an unwind for the VGA arbiter registration.\n\nIn current kernels this is mostly benign because vfio_pci_set_decode()\nonly uses pci_dev state, but the original failure path could leave a\ncallback with a freed vdev cookie. The stale registration also becomes\nunsafe again once the callback follows drvdata to the vfio device.\n\nAdd the required VGA unwind callout."}],"id":"CVE-2026-64475","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64475","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:16.888282Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:32.980","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0f2a35a0c7ea7da347b814750eaa78adf3582381"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/278a5659c391fe5afe5f9ce1bad1fd24e90144f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/42d758a09d2c46c42357ecde9a5492f015bde2e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/52adb2dff7ce3d8430e2bdc5988b618a430def85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8d65decde9afd2bd78bcfffdc0df73b82a0b5509"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9e0a3f642e607848669235f5069f35640abbfc88"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/daedde7f024ecf88bc8e832ed40cf2c795f0796a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ef4c38d30b3744e89eb5048218904bb629ea8d47"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0f2a35a0c7ea7da347b814750eaa78adf3582381","status":"affected","version":"87856f9af04eaacf9848710625a4ffee1d020fa9","versionType":"git"},{"lessThan":"8d65decde9afd2bd78bcfffdc0df73b82a0b5509","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"ef4c38d30b3744e89eb5048218904bb629ea8d47","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"9e0a3f642e607848669235f5069f35640abbfc88","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"42d758a09d2c46c42357ecde9a5492f015bde2e5","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"52adb2dff7ce3d8430e2bdc5988b618a430def85","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"278a5659c391fe5afe5f9ce1bad1fd24e90144f1","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"lessThan":"daedde7f024ecf88bc8e832ed40cf2c795f0796a","status":"affected","version":"4aeec3984ddc853f7c65903bde472ffdef738bae","versionType":"git"},{"status":"affected","version":"d62dccb417cf972c978bf3c68a7d5e846bcf953e","versionType":"git"},{"status":"affected","version":"6694b8daffac5a8661071f085608afc78f7acd08","versionType":"git"},{"lessThan":"5.10.261","status":"affected","version":"5.10.37","versionType":"semver"},{"lessThan":"5.12","status":"affected","version":"5.11.21","versionType":"semver"},{"lessThan":"5.13","status":"affected","version":"5.12.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE8756D6-357E-4040-B070-69B0C871B43D","versionEndExcluding":"5.10.261","versionStartIncluding":"5.10.37","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5D4778B3-2521-408B-900C-9048E76A0D8C","versionEndExcluding":"5.12","versionStartIncluding":"5.11.21","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E128F466-0068-49BD-8CE7-C9AA3BA7CAC7","versionEndExcluding":"5.15.212","versionStartIncluding":"5.12.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Release the VGA arbiter client on register_device() failure\n\nThe re-order in the Fixes commit below displaced vfio_pci_vga_init() as\nthe last failure point of what is now vfio_pci_core_register_device()\nwithout introducing an unwind for the VGA arbiter registration.\n\nIn current kernels this is mostly benign because vfio_pci_set_decode()\nonly uses pci_dev state, but the original failure path could leave a\ncallback with a freed vdev cookie. The stale registration also becomes\nunsafe again once the callback follows drvdata to the vfio device.\n\nAdd the required VGA unwind callout."}],"id":"CVE-2026-64475","lastModified":"2026-11-12T20:37:08.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64475","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:16.888282Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:32.980","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f2a35a0c7ea7da347b814750eaa78adf3582381"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/278a5659c391fe5afe5f9ce1bad1fd24e90144f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42d758a09d2c46c42357ecde9a5492f015bde2e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52adb2dff7ce3d8430e2bdc5988b618a430def85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d65decde9afd2bd78bcfffdc0df73b82a0b5509"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e0a3f642e607848669235f5069f35640abbfc88"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/daedde7f024ecf88bc8e832ed40cf2c795f0796a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef4c38d30b3744e89eb5048218904bb629ea8d47"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64476.json b/data/2026/CVE-2026-64476.json index e8e98d76ae..0f529b802e 100644 --- a/data/2026/CVE-2026-64476.json +++ b/data/2026/CVE-2026-64476.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_core.c","include/linux/vfio_pci_core.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"332d785f9ae426eeeb92527872adf09d84101ba3","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"},{"lessThan":"654710ef3135c4546b20a903bc23a51b0c44d6c8","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"},{"lessThan":"b98296816d31441b307ef9fa8670dcf5a55e5505","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"},{"lessThan":"f6c67cf0051f96ba61d186731d3d9409b9927db2","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"},{"lessThan":"062b820290bcb9778e43a73597df76e9bb08acfb","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"},{"lessThan":"4575e9aac5336d1365138c0284773bf8da4b1fa3","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_core.c","include/linux/vfio_pci_core.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Latch disable_idle_d3 per device\n\nWhen disable_idle_d3 was introduced in vfio-pci, it directly manipulated\nthe device power state with pci_set_power_state(). There were no\nrefcounts to maintain or balanced operations, we could unconditionally\nbring the device to D0 and conditionally move it to D3hot. Therefore\nthe module parameter was made writable.\n\nLater, in commit c61302aa48f7 (\"vfio/pci: Move module parameters to\nvfio_pci.c\"), as part of the vfio-pci-core split, the writable aspect\nof the module parameter was nullified. The parameter value could still\nbe changed through sysfs, but the vfio-pci driver latched the values\ninto vfio-pci-core globals at module init. Loading the vfio-pci module,\nor unloading and reloading, with non-default or different values could\nchange the globals relative to existing devices bound to vfio-pci\nvariant drivers.\n\nRuntime PM was introduced in commit 7ab5e10eda02 (\"vfio/pci: Move the\nunused device into low power state with runtime PM\"), which marks the\npoint where power states became refcounted. PM get and put operations\nneed to be balanced, but the same module operations noted above can\nchange the global variables relative to those devices already bound to\nvfio-pci variant drivers. This introduces a window where PM operations\ncan now become unbalanced.\n\nTo resolve this with a narrow footprint for stable backports, the\ndisable_idle_d3 flag is latched into the vfio_pci_core_device at the\ntime of initialization, such that the device always operates with a\nconsistent value.\n\nNB. vfio_pci_dev_set_try_reset() now unconditionally raises the\nruntime PM usage count around bus reset to account for disable_idle_d3\nbecoming a per-device rather than global flag. When this flag is set,\nthe additional get/put pair is harmless and allows continued use of the\nshared vfio_pci_dev_set_pm_runtime_get() helper."}],"id":"CVE-2026-64476","lastModified":"2026-11-06T17:18:56.110","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64476","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:39:40.454505Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:33.113","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/062b820290bcb9778e43a73597df76e9bb08acfb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/332d785f9ae426eeeb92527872adf09d84101ba3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4575e9aac5336d1365138c0284773bf8da4b1fa3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/654710ef3135c4546b20a903bc23a51b0c44d6c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b98296816d31441b307ef9fa8670dcf5a55e5505"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f6c67cf0051f96ba61d186731d3d9409b9927db2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_core.c","include/linux/vfio_pci_core.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"332d785f9ae426eeeb92527872adf09d84101ba3","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"},{"lessThan":"654710ef3135c4546b20a903bc23a51b0c44d6c8","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"},{"lessThan":"b98296816d31441b307ef9fa8670dcf5a55e5505","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"},{"lessThan":"f6c67cf0051f96ba61d186731d3d9409b9927db2","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"},{"lessThan":"062b820290bcb9778e43a73597df76e9bb08acfb","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"},{"lessThan":"4575e9aac5336d1365138c0284773bf8da4b1fa3","status":"affected","version":"7ab5e10eda02da1d9562ffde562c51055d368e9c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_core.c","include/linux/vfio_pci_core.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CFE34378-E34A-4EB8-94FC-23E73A95EB5D","versionEndExcluding":"6.1.178","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Latch disable_idle_d3 per device\n\nWhen disable_idle_d3 was introduced in vfio-pci, it directly manipulated\nthe device power state with pci_set_power_state(). There were no\nrefcounts to maintain or balanced operations, we could unconditionally\nbring the device to D0 and conditionally move it to D3hot. Therefore\nthe module parameter was made writable.\n\nLater, in commit c61302aa48f7 (\"vfio/pci: Move module parameters to\nvfio_pci.c\"), as part of the vfio-pci-core split, the writable aspect\nof the module parameter was nullified. The parameter value could still\nbe changed through sysfs, but the vfio-pci driver latched the values\ninto vfio-pci-core globals at module init. Loading the vfio-pci module,\nor unloading and reloading, with non-default or different values could\nchange the globals relative to existing devices bound to vfio-pci\nvariant drivers.\n\nRuntime PM was introduced in commit 7ab5e10eda02 (\"vfio/pci: Move the\nunused device into low power state with runtime PM\"), which marks the\npoint where power states became refcounted. PM get and put operations\nneed to be balanced, but the same module operations noted above can\nchange the global variables relative to those devices already bound to\nvfio-pci variant drivers. This introduces a window where PM operations\ncan now become unbalanced.\n\nTo resolve this with a narrow footprint for stable backports, the\ndisable_idle_d3 flag is latched into the vfio_pci_core_device at the\ntime of initialization, such that the device always operates with a\nconsistent value.\n\nNB. vfio_pci_dev_set_try_reset() now unconditionally raises the\nruntime PM usage count around bus reset to account for disable_idle_d3\nbecoming a per-device rather than global flag. When this flag is set,\nthe additional get/put pair is harmless and allows continued use of the\nshared vfio_pci_dev_set_pm_runtime_get() helper."}],"id":"CVE-2026-64476","lastModified":"2026-11-12T17:52:44.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64476","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:39:40.454505Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:33.113","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/062b820290bcb9778e43a73597df76e9bb08acfb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/332d785f9ae426eeeb92527872adf09d84101ba3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4575e9aac5336d1365138c0284773bf8da4b1fa3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/654710ef3135c4546b20a903bc23a51b0c44d6c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b98296816d31441b307ef9fa8670dcf5a55e5505"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6c67cf0051f96ba61d186731d3d9409b9927db2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64478.json b/data/2026/CVE-2026-64478.json index 133109ed24..c8bfb56673 100644 --- a/data/2026/CVE-2026-64478.json +++ b/data/2026/CVE-2026-64478.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/mixer_quirks.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e4c66a149c408e44e60bfec3fabf08b6b7abbc60","status":"affected","version":"d0b0264009596c07a77d82808b0dae72bc04ac5c","versionType":"git"},{"lessThan":"4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e","status":"affected","version":"b4b94f092f193d7a2db8e82af5e51519ae89963c","versionType":"git"},{"lessThan":"662a1d7b5affc424ea4f4bc20dd99be29e687886","status":"affected","version":"c2d5b0a6c688ffb32c35627e337fbbcc65bc275f","versionType":"git"},{"lessThan":"a47ecd904c51ae6a42957feb3cf2f4266adee2e5","status":"affected","version":"d04d301614630724feb4048bf17432fc7964fe74","versionType":"git"},{"lessThan":"c1da6d3f45036fa63672ee04ad97cb526b40b987","status":"affected","version":"a705899ec6085b12a33aa0fd94a58e82e9e90502","versionType":"git"},{"lessThan":"a263eb12cbe2e208e6e637df0f9b0be9a484158e","status":"affected","version":"79d561c4ec0497669f19a9550cfb74812f60938b","versionType":"git"},{"lessThan":"4246dd043b7a4f8e3bc1d2896e81d11220610eda","status":"affected","version":"79d561c4ec0497669f19a9550cfb74812f60938b","versionType":"git"},{"lessThan":"7693c0cc415f3a16a7a3355f245474a5e661be4e","status":"affected","version":"79d561c4ec0497669f19a9550cfb74812f60938b","versionType":"git"},{"status":"affected","version":"104ad9bae11ee450fb7d0595ff7876cfb6527838","versionType":"git"},{"status":"affected","version":"0105cfc41abeb428d4405951a20e1e239bea5e1d","versionType":"git"},{"lessThan":"5.10.261","status":"affected","version":"5.10.245","versionType":"semver"},{"lessThan":"5.15.212","status":"affected","version":"5.15.194","versionType":"semver"},{"lessThan":"6.1.178","status":"affected","version":"6.1.155","versionType":"semver"},{"lessThan":"6.6.145","status":"affected","version":"6.6.109","versionType":"semver"},{"lessThan":"6.12.96","status":"affected","version":"6.12.50","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.300","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/mixer_quirks.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: avoid kobject path lookup in DualSense match\n\nThe DualSense jack-detection input handler verifies that a matching input\ndevice belongs to the same physical controller by building kobject path\nstrings for both the input device and the USB audio device, then comparing\nthe path prefix.\n\nThis was observed when a weak physical connection caused the controller\nto rapidly disconnect and reconnect. During that repeated hotplug,\nsnd_dualsense_ih_match() can run while the controller's USB device is\nbeing disconnected. kobject_get_path() walks ancestor kobjects and\ndereferences their names; if the USB device kobject name is no longer\nvalid, this can fault in strlen():\n\n RIP: 0010:strlen+0x10/0x30\n Call Trace:\n kobject_get_path+0x34/0x150\n snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]\n input_register_device+0x566/0x6a0\n ps_probe+0xb89/0x1590 [hid_playstation]\n\nThe same ownership check can be done without building kobject path\nstrings. The input device is parented below the HID device, USB interface\nand USB device, so walking the input device parent chain and comparing\nagainst the mixer USB device preserves the check without dereferencing\nkobject names during disconnect."}],"id":"CVE-2026-64478","lastModified":"2026-11-06T17:18:56.303","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64478","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:39:50.444032Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:33.350","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4246dd043b7a4f8e3bc1d2896e81d11220610eda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/662a1d7b5affc424ea4f4bc20dd99be29e687886"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7693c0cc415f3a16a7a3355f245474a5e661be4e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a263eb12cbe2e208e6e637df0f9b0be9a484158e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a47ecd904c51ae6a42957feb3cf2f4266adee2e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c1da6d3f45036fa63672ee04ad97cb526b40b987"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e4c66a149c408e44e60bfec3fabf08b6b7abbc60"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/mixer_quirks.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e4c66a149c408e44e60bfec3fabf08b6b7abbc60","status":"affected","version":"d0b0264009596c07a77d82808b0dae72bc04ac5c","versionType":"git"},{"lessThan":"4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e","status":"affected","version":"b4b94f092f193d7a2db8e82af5e51519ae89963c","versionType":"git"},{"lessThan":"662a1d7b5affc424ea4f4bc20dd99be29e687886","status":"affected","version":"c2d5b0a6c688ffb32c35627e337fbbcc65bc275f","versionType":"git"},{"lessThan":"a47ecd904c51ae6a42957feb3cf2f4266adee2e5","status":"affected","version":"d04d301614630724feb4048bf17432fc7964fe74","versionType":"git"},{"lessThan":"c1da6d3f45036fa63672ee04ad97cb526b40b987","status":"affected","version":"a705899ec6085b12a33aa0fd94a58e82e9e90502","versionType":"git"},{"lessThan":"a263eb12cbe2e208e6e637df0f9b0be9a484158e","status":"affected","version":"79d561c4ec0497669f19a9550cfb74812f60938b","versionType":"git"},{"lessThan":"4246dd043b7a4f8e3bc1d2896e81d11220610eda","status":"affected","version":"79d561c4ec0497669f19a9550cfb74812f60938b","versionType":"git"},{"lessThan":"7693c0cc415f3a16a7a3355f245474a5e661be4e","status":"affected","version":"79d561c4ec0497669f19a9550cfb74812f60938b","versionType":"git"},{"status":"affected","version":"104ad9bae11ee450fb7d0595ff7876cfb6527838","versionType":"git"},{"status":"affected","version":"0105cfc41abeb428d4405951a20e1e239bea5e1d","versionType":"git"},{"lessThan":"5.10.261","status":"affected","version":"5.10.245","versionType":"semver"},{"lessThan":"5.15.212","status":"affected","version":"5.15.194","versionType":"semver"},{"lessThan":"6.1.178","status":"affected","version":"6.1.155","versionType":"semver"},{"lessThan":"6.6.145","status":"affected","version":"6.6.109","versionType":"semver"},{"lessThan":"6.12.96","status":"affected","version":"6.12.50","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.300","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/mixer_quirks.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"86B3E7E5-E0BE-45EF-8283-0915632E4002","versionEndExcluding":"5.5","versionStartIncluding":"5.4.300","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A4F25EAB-F7A8-4280-B6F4-8D33FED12450","versionEndExcluding":"5.10.261","versionStartIncluding":"5.10.245","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"622FB48A-F0B6-45FC-8CC8-2E397DF19179","versionEndExcluding":"5.15.212","versionStartIncluding":"5.15.194","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15ADE030-F915-48D7-A9C2-B2B55313BA64","versionEndExcluding":"6.1.178","versionStartIncluding":"6.1.155","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CD19B5A9-297C-438F-BB6E-D2E93509030F","versionEndExcluding":"6.6.145","versionStartIncluding":"6.6.109","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4675CDE7-120A-4DC7-B028-06912198D79E","versionEndExcluding":"6.12.96","versionStartIncluding":"6.12.50","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"70110939-86C5-468C-9BB7-E2F38F7A5193","versionEndExcluding":"6.18.39","versionStartIncluding":"6.16.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: avoid kobject path lookup in DualSense match\n\nThe DualSense jack-detection input handler verifies that a matching input\ndevice belongs to the same physical controller by building kobject path\nstrings for both the input device and the USB audio device, then comparing\nthe path prefix.\n\nThis was observed when a weak physical connection caused the controller\nto rapidly disconnect and reconnect. During that repeated hotplug,\nsnd_dualsense_ih_match() can run while the controller's USB device is\nbeing disconnected. kobject_get_path() walks ancestor kobjects and\ndereferences their names; if the USB device kobject name is no longer\nvalid, this can fault in strlen():\n\n RIP: 0010:strlen+0x10/0x30\n Call Trace:\n kobject_get_path+0x34/0x150\n snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]\n input_register_device+0x566/0x6a0\n ps_probe+0xb89/0x1590 [hid_playstation]\n\nThe same ownership check can be done without building kobject path\nstrings. The input device is parented below the HID device, USB interface\nand USB device, so walking the input device parent chain and comparing\nagainst the mixer USB device preserves the check without dereferencing\nkobject names during disconnect."}],"id":"CVE-2026-64478","lastModified":"2026-11-12T17:46:08.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64478","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:39:50.444032Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:33.350","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4246dd043b7a4f8e3bc1d2896e81d11220610eda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/662a1d7b5affc424ea4f4bc20dd99be29e687886"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7693c0cc415f3a16a7a3355f245474a5e661be4e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a263eb12cbe2e208e6e637df0f9b0be9a484158e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a47ecd904c51ae6a42957feb3cf2f4266adee2e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1da6d3f45036fa63672ee04ad97cb526b40b987"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e4c66a149c408e44e60bfec3fabf08b6b7abbc60"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64487.json b/data/2026/CVE-2026-64487.json index b380c8f4c0..df881bf525 100644 --- a/data/2026/CVE-2026-64487.json +++ b/data/2026/CVE-2026-64487.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/caiaq/input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"de5f9edc705497b1b2c6b173b22f283486d2fd91","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"884f575cc6acb136eb4a161d925147f85b59c27e","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"05df59b9a61f7ca66548df079d306c41da23845d","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"3cad86197c7bf8b45bb1d8adc1099d0913e80469","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"a5fd3122283bf75c04f6414bf610100beb0565b0","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"0680413f2f10aab43878dd3db711a6a9e45bab7c","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/caiaq/input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.37"},{"lessThan":"2.6.37","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser\n\nsnd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input\nstream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every\niteration it advances buf and subtracts the block size while looping on\n\"while (len)\".\n\nlen is urb->actual_length. That value is supplied by the device and is\nnot guaranteed to be a multiple of 16. When a final short block leaves\nlen between 1 and 15, the loop runs once more, reads up to buf[15], and\nthen does \"len -= TKS4_MSGBLOCK_SIZE\". As len is unsigned this underflows\nto a huge value. The loop then keeps iterating and walking buf far past\nthe end of the 512-byte ep4_in_buf, reading out of bounds until a bogus\nblock id happens to be hit.\n\nIterate only while a full message block is available. This stops the\nunsigned underflow and silently drops any trailing partial block, which\ncarries no complete control value anyway.\n\nThe sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1\nand Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor\nurb->actual_length before dispatching."}],"id":"CVE-2026-64487","lastModified":"2026-11-06T17:18:57.000","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64487","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:40:21.910578Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:34.423","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/05df59b9a61f7ca66548df079d306c41da23845d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0680413f2f10aab43878dd3db711a6a9e45bab7c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3cad86197c7bf8b45bb1d8adc1099d0913e80469"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/884f575cc6acb136eb4a161d925147f85b59c27e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a5fd3122283bf75c04f6414bf610100beb0565b0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/de5f9edc705497b1b2c6b173b22f283486d2fd91"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/caiaq/input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"de5f9edc705497b1b2c6b173b22f283486d2fd91","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"884f575cc6acb136eb4a161d925147f85b59c27e","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"05df59b9a61f7ca66548df079d306c41da23845d","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"3cad86197c7bf8b45bb1d8adc1099d0913e80469","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"a5fd3122283bf75c04f6414bf610100beb0565b0","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"0680413f2f10aab43878dd3db711a6a9e45bab7c","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"},{"lessThan":"f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd","status":"affected","version":"15c5ab607045e278ebf4d2ca4aea2250617d50ca","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/caiaq/input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.37"},{"lessThan":"2.6.37","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4BFEF828-4234-4F3F-B67B-5DF767069809","versionEndExcluding":"5.10.261","versionStartIncluding":"2.6.37","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser\n\nsnd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input\nstream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every\niteration it advances buf and subtracts the block size while looping on\n\"while (len)\".\n\nlen is urb->actual_length. That value is supplied by the device and is\nnot guaranteed to be a multiple of 16. When a final short block leaves\nlen between 1 and 15, the loop runs once more, reads up to buf[15], and\nthen does \"len -= TKS4_MSGBLOCK_SIZE\". As len is unsigned this underflows\nto a huge value. The loop then keeps iterating and walking buf far past\nthe end of the 512-byte ep4_in_buf, reading out of bounds until a bogus\nblock id happens to be hit.\n\nIterate only while a full message block is available. This stops the\nunsigned underflow and silently drops any trailing partial block, which\ncarries no complete control value anyway.\n\nThe sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1\nand Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor\nurb->actual_length before dispatching."}],"id":"CVE-2026-64487","lastModified":"2026-11-12T18:09:44.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64487","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:40:21.910578Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:34.423","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/05df59b9a61f7ca66548df079d306c41da23845d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0680413f2f10aab43878dd3db711a6a9e45bab7c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3cad86197c7bf8b45bb1d8adc1099d0913e80469"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/884f575cc6acb136eb4a161d925147f85b59c27e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a5fd3122283bf75c04f6414bf610100beb0565b0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de5f9edc705497b1b2c6b173b22f283486d2fd91"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64504.json b/data/2026/CVE-2026-64504.json index a30e041608..6454e26c2a 100644 --- a/data/2026/CVE-2026-64504.json +++ b/data/2026/CVE-2026-64504.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/accel/bmc150-accel-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b5a9f521e0a49a0266200fd535b32a9668ecb33b","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"2fe0531dd73eff1de0f2584cb77716d645e548d5","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"89f4a4ca0ac3a933c750569a771c079a290b0721","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"3e766526827acd542bcd36c20c4d5f397e0f6521","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"35a3cd8fd65e15029eb90f1e510045b1bb071175","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"ce0e1cae26096fe959a0da5563a6d6d5a801d5fb","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/accel/bmc150-accel-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.1"},{"lessThan":"4.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: bmc150: clamp the device-reported FIFO frame count\n\n__bmc150_accel_fifo_flush() copies the number of samples the device\nreports in its hardware FIFO into an on-stack buffer\n\n\tu16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];\n\nwhich is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The\nframe count is read from the FIFO_STATUS register and only masked to its\n7 valid bits:\n\n\tcount = val & 0x7F;\n\nso it can be 0..127. The only other limit applied to it is the optional\ncaller-supplied sample budget:\n\n\tif (samples && count > samples)\n\t\tcount = samples;\n\nwhich does not constrain count on the flush-all path (samples == 0), and\nleaves it well above 32 whenever samples is larger. count samples are\nthen transferred into buffer[]:\n\n\tbmc150_accel_fifo_transfer(data, (u8 *)buffer, count);\n\nbmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a\nmalfunctioning, malicious or counterfeit accelerometer (or an attacker\ntampering with the I2C/SPI bus) that reports up to 127 frames writes up\nto 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up\nto 570 bytes that clobbers the stack canary, saved registers and the\nreturn address.\n\nClamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[]\nis sized for, before the transfer, mirroring the watermark clamp already\ndone in bmc150_accel_set_watermark(). A well-formed flush reports at most\nBMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected."}],"id":"CVE-2026-64504","lastModified":"2026-11-06T17:18:57.520","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:40:33.324913Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:36.443","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2fe0531dd73eff1de0f2584cb77716d645e548d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/35a3cd8fd65e15029eb90f1e510045b1bb071175"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3e766526827acd542bcd36c20c4d5f397e0f6521"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/89f4a4ca0ac3a933c750569a771c079a290b0721"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b5a9f521e0a49a0266200fd535b32a9668ecb33b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ce0e1cae26096fe959a0da5563a6d6d5a801d5fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/accel/bmc150-accel-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b5a9f521e0a49a0266200fd535b32a9668ecb33b","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"2fe0531dd73eff1de0f2584cb77716d645e548d5","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"89f4a4ca0ac3a933c750569a771c079a290b0721","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"3e766526827acd542bcd36c20c4d5f397e0f6521","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"35a3cd8fd65e15029eb90f1e510045b1bb071175","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"},{"lessThan":"ce0e1cae26096fe959a0da5563a6d6d5a801d5fb","status":"affected","version":"3bbec9773389112330954a6a64422eaa78d546c1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/accel/bmc150-accel-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.1"},{"lessThan":"4.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2C338AC7-51C3-43D3-8E70-66343021315C","versionEndExcluding":"5.10.261","versionStartIncluding":"4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: bmc150: clamp the device-reported FIFO frame count\n\n__bmc150_accel_fifo_flush() copies the number of samples the device\nreports in its hardware FIFO into an on-stack buffer\n\n\tu16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];\n\nwhich is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The\nframe count is read from the FIFO_STATUS register and only masked to its\n7 valid bits:\n\n\tcount = val & 0x7F;\n\nso it can be 0..127. The only other limit applied to it is the optional\ncaller-supplied sample budget:\n\n\tif (samples && count > samples)\n\t\tcount = samples;\n\nwhich does not constrain count on the flush-all path (samples == 0), and\nleaves it well above 32 whenever samples is larger. count samples are\nthen transferred into buffer[]:\n\n\tbmc150_accel_fifo_transfer(data, (u8 *)buffer, count);\n\nbmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a\nmalfunctioning, malicious or counterfeit accelerometer (or an attacker\ntampering with the I2C/SPI bus) that reports up to 127 frames writes up\nto 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up\nto 570 bytes that clobbers the stack canary, saved registers and the\nreturn address.\n\nClamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[]\nis sized for, before the transfer, mirroring the watermark clamp already\ndone in bmc150_accel_set_watermark(). A well-formed flush reports at most\nBMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected."}],"id":"CVE-2026-64504","lastModified":"2026-11-12T18:25:29.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:40:33.324913Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:36.443","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2fe0531dd73eff1de0f2584cb77716d645e548d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/35a3cd8fd65e15029eb90f1e510045b1bb071175"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e766526827acd542bcd36c20c4d5f397e0f6521"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/89f4a4ca0ac3a933c750569a771c079a290b0721"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5a9f521e0a49a0266200fd535b32a9668ecb33b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ce0e1cae26096fe959a0da5563a6d6d5a801d5fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64505.json b/data/2026/CVE-2026-64505.json index 9f523400a3..382157e2f6 100644 --- a/data/2026/CVE-2026-64505.json +++ b/data/2026/CVE-2026-64505.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/rndis.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"200dd5092296ad4d5ae47f8445a2fb1edd1da973","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"9ffd567d7bf269824dfac06f8ab9a32fef72699b","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"b73c0142e3acdc063b50c33afb7be19cdb2cd410","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"d6ef5af7d0fe1ac31e5653a77e6d775dd36bc433","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"ba2cc601e59fe68716646199a33303493513e2e3","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"7515a6d4a9e9e4838b833825882efa00e85f8901","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"9facd79028a7807879eb441d12f0e00720980aa3","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"21b5bf155435008e0fb0736795289788e63d426f","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/rndis.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: function: rndis: add length check for header\n\nAdd a length check for the rndis header in rndis_rm_hdr, to ensure that\nMessageType, MessageLength, DataOffset, and DataLength fields are\npresent before they are accessed."}],"id":"CVE-2026-64505","lastModified":"2026-11-03T18:15:39.353","metrics":{},"published":"2026-07-25T10:17:36.583","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/200dd5092296ad4d5ae47f8445a2fb1edd1da973"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/21b5bf155435008e0fb0736795289788e63d426f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7515a6d4a9e9e4838b833825882efa00e85f8901"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9facd79028a7807879eb441d12f0e00720980aa3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9ffd567d7bf269824dfac06f8ab9a32fef72699b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b73c0142e3acdc063b50c33afb7be19cdb2cd410"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ba2cc601e59fe68716646199a33303493513e2e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d6ef5af7d0fe1ac31e5653a77e6d775dd36bc433"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/rndis.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"200dd5092296ad4d5ae47f8445a2fb1edd1da973","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"9ffd567d7bf269824dfac06f8ab9a32fef72699b","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"b73c0142e3acdc063b50c33afb7be19cdb2cd410","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"d6ef5af7d0fe1ac31e5653a77e6d775dd36bc433","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"ba2cc601e59fe68716646199a33303493513e2e3","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"7515a6d4a9e9e4838b833825882efa00e85f8901","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"9facd79028a7807879eb441d12f0e00720980aa3","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"},{"lessThan":"21b5bf155435008e0fb0736795289788e63d426f","status":"affected","version":"6cdee106e7571751ecc0e9f96606322f88b64a8d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/rndis.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"957C42C7-357C-4EAA-BCE7-2A8821A5B248","versionEndExcluding":"5.10.261","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: function: rndis: add length check for header\n\nAdd a length check for the rndis header in rndis_rm_hdr, to ensure that\nMessageType, MessageLength, DataOffset, and DataLength fields are\npresent before they are accessed."}],"id":"CVE-2026-64505","lastModified":"2026-11-12T18:26:52.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-25T10:17:36.583","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/200dd5092296ad4d5ae47f8445a2fb1edd1da973"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21b5bf155435008e0fb0736795289788e63d426f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7515a6d4a9e9e4838b833825882efa00e85f8901"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9facd79028a7807879eb441d12f0e00720980aa3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ffd567d7bf269824dfac06f8ab9a32fef72699b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b73c0142e3acdc063b50c33afb7be19cdb2cd410"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba2cc601e59fe68716646199a33303493513e2e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d6ef5af7d0fe1ac31e5653a77e6d775dd36bc433"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64506.json b/data/2026/CVE-2026-64506.json index 703c8324b9..7b6159573c 100644 --- a/data/2026/CVE-2026-64506.json +++ b/data/2026/CVE-2026-64506.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/realtek/rtw89/core.c","drivers/net/wireless/realtek/rtw89/mac80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"994994cfadaf1fd362dea9b8d9d633f85dc1b3c3","status":"affected","version":"bda294ed0ed05ada2a832b19a55dd4a6fa72b1a1","versionType":"git"},{"lessThan":"63ccdfac8677387dfdbd9d4336089e9823280704","status":"affected","version":"bda294ed0ed05ada2a832b19a55dd4a6fa72b1a1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/realtek/rtw89/core.c","drivers/net/wireless/realtek/rtw89/mac80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: correct drop logic for malformed AMPDU frames\n\nThe previous commit aims to fix issue caused by malformed AMPDU frames.\nBut the drop logic fails to deal with the first AMPDU packet paired with\ncertain range of sequence number, and leads to unexpected packet drop.\nIt is more likely to encounter this failure when there are busy traffic\nduring rekey process and could lead to disconnection from the AP.\nFix this by adding a initial state judgement and only reset status\nduring pairwise rekey."}],"id":"CVE-2026-64506","lastModified":"2026-11-03T18:15:39.353","metrics":{},"published":"2026-07-25T10:17:36.710","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/63ccdfac8677387dfdbd9d4336089e9823280704"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/994994cfadaf1fd362dea9b8d9d633f85dc1b3c3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/realtek/rtw89/core.c","drivers/net/wireless/realtek/rtw89/mac80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"994994cfadaf1fd362dea9b8d9d633f85dc1b3c3","status":"affected","version":"bda294ed0ed05ada2a832b19a55dd4a6fa72b1a1","versionType":"git"},{"lessThan":"63ccdfac8677387dfdbd9d4336089e9823280704","status":"affected","version":"bda294ed0ed05ada2a832b19a55dd4a6fa72b1a1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/realtek/rtw89/core.c","drivers/net/wireless/realtek/rtw89/mac80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7D22B17B-4F96-43BE-835F-3A80228838B0","versionEndExcluding":"7.1.4","versionStartIncluding":"7.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: correct drop logic for malformed AMPDU frames\n\nThe previous commit aims to fix issue caused by malformed AMPDU frames.\nBut the drop logic fails to deal with the first AMPDU packet paired with\ncertain range of sequence number, and leads to unexpected packet drop.\nIt is more likely to encounter this failure when there are busy traffic\nduring rekey process and could lead to disconnection from the AP.\nFix this by adding a initial state judgement and only reset status\nduring pairwise rekey."}],"id":"CVE-2026-64506","lastModified":"2026-11-12T19:33:14.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-25T10:17:36.710","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63ccdfac8677387dfdbd9d4336089e9823280704"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/994994cfadaf1fd362dea9b8d9d633f85dc1b3c3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-670"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64507.json b/data/2026/CVE-2026-64507.json index 846434a918..797e2677f0 100644 --- a/data/2026/CVE-2026-64507.json +++ b/data/2026/CVE-2026-64507.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/include/asm/nospec-branch.h","arch/x86/kernel/cpu/bugs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"25dbcd31781e2bc3cd63d873af1fcd06f863a126","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"cb27f3bf915cc0f20fc0c48da9059304e39ebd35","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"9354248fc1c33a844ca1872761f6668b393e8c37","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"52440e15d9628f8f239373c0f2e5e8f92feea2df","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"a3af84b0fa00ead01fcd0e28b5d773ff25990a0d","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/include/asm/nospec-branch.h","arch/x86/kernel/cpu/bugs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Enable IBPB flush on BPF JIT allocation\n\nEnable hardening against JIT spraying when Spectre-v2 mitigations are in\nuse. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip\nenabling the IBPB flush if the BPF dispatcher is already using a retpoline\nsequence.\n\nThis hardening applies only when BPF-JIT is in use. Guard the enabling\nunder CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n."}],"id":"CVE-2026-64507","lastModified":"2026-11-06T17:18:57.933","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:40:39.454506Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:36.810","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/25dbcd31781e2bc3cd63d873af1fcd06f863a126"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/52440e15d9628f8f239373c0f2e5e8f92feea2df"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9354248fc1c33a844ca1872761f6668b393e8c37"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a3af84b0fa00ead01fcd0e28b5d773ff25990a0d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cb27f3bf915cc0f20fc0c48da9059304e39ebd35"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/include/asm/nospec-branch.h","arch/x86/kernel/cpu/bugs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"25dbcd31781e2bc3cd63d873af1fcd06f863a126","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"cb27f3bf915cc0f20fc0c48da9059304e39ebd35","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"9354248fc1c33a844ca1872761f6668b393e8c37","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"52440e15d9628f8f239373c0f2e5e8f92feea2df","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"a3af84b0fa00ead01fcd0e28b5d773ff25990a0d","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/include/asm/nospec-branch.h","arch/x86/kernel/cpu/bugs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE901C11-FE18-4B1A-ADE5-A378E267F82D","versionEndExcluding":"6.1.183","versionStartIncluding":"5.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Enable IBPB flush on BPF JIT allocation\n\nEnable hardening against JIT spraying when Spectre-v2 mitigations are in\nuse. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip\nenabling the IBPB flush if the BPF dispatcher is already using a retpoline\nsequence.\n\nThis hardening applies only when BPF-JIT is in use. Guard the enabling\nunder CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n."}],"id":"CVE-2026-64507","lastModified":"2026-11-12T19:23:35.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:40:39.454506Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:36.810","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25dbcd31781e2bc3cd63d873af1fcd06f863a126"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52440e15d9628f8f239373c0f2e5e8f92feea2df"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9354248fc1c33a844ca1872761f6668b393e8c37"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3af84b0fa00ead01fcd0e28b5d773ff25990a0d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cb27f3bf915cc0f20fc0c48da9059304e39ebd35"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64508.json b/data/2026/CVE-2026-64508.json index ee356401b8..3f70588c2a 100644 --- a/data/2026/CVE-2026-64508.json +++ b/data/2026/CVE-2026-64508.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/filter.h","kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1fbafd5235ca897b322161659ebe8ba651b00b3b","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"6e52c240c43a601b681e3a4e58fc5685114d4726","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"eed774da601268dae674e14d54a15e3624691f52","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"8ff183ee4d8c452960df58175a094828c0513b2e","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"7a6c171c6a1ac6d1509752dac131d941a3de0b37","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"96cce16e26dd02a8678f1e87f88a4b5cdb63b995","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/filter.h","kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Support for hardening against JIT spraying\n\nThe BPF JIT allocator packs many small programs into larger executable\nallocations and reuses space within those allocations as programs are\nloaded and freed. When fresh code is written into space that a previous\nprogram occupied, an indirect jump into the new program can reuse a branch\nprediction left behind by the old one.\n\nFlush the indirect branch predictors before reusing JIT memory so that\nindirect jumps into a newly written program don't reuse predictions from an\nold program that occupied the same space.\n\nIntroduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush\nstatic call for flushing the branch predictors on JIT memory reuse.\nArchitectures that need a flush, can update it to a predictor flush\nfunction. By default, its a NOP and does not emit any CALL.\n\nAllocations larger than a pack are not covered by this flush. That is safe\nbecause cBPF programs (the unprivileged attack surface) are bounded well\nbelow a pack size. Issue a warning if this assumption is ever violated\nwhile the flush is active."}],"id":"CVE-2026-64508","lastModified":"2026-11-06T17:18:58.230","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:40:46.106500Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:36.920","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1fbafd5235ca897b322161659ebe8ba651b00b3b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6e52c240c43a601b681e3a4e58fc5685114d4726"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7a6c171c6a1ac6d1509752dac131d941a3de0b37"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8ff183ee4d8c452960df58175a094828c0513b2e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/96cce16e26dd02a8678f1e87f88a4b5cdb63b995"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/eed774da601268dae674e14d54a15e3624691f52"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/filter.h","kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1fbafd5235ca897b322161659ebe8ba651b00b3b","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"6e52c240c43a601b681e3a4e58fc5685114d4726","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"eed774da601268dae674e14d54a15e3624691f52","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"8ff183ee4d8c452960df58175a094828c0513b2e","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"7a6c171c6a1ac6d1509752dac131d941a3de0b37","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"},{"lessThan":"96cce16e26dd02a8678f1e87f88a4b5cdb63b995","status":"affected","version":"57631054fae6dcc9c892ae6310b58bbb6f6e5048","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/filter.h","kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE901C11-FE18-4B1A-ADE5-A378E267F82D","versionEndExcluding":"6.1.183","versionStartIncluding":"5.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Support for hardening against JIT spraying\n\nThe BPF JIT allocator packs many small programs into larger executable\nallocations and reuses space within those allocations as programs are\nloaded and freed. When fresh code is written into space that a previous\nprogram occupied, an indirect jump into the new program can reuse a branch\nprediction left behind by the old one.\n\nFlush the indirect branch predictors before reusing JIT memory so that\nindirect jumps into a newly written program don't reuse predictions from an\nold program that occupied the same space.\n\nIntroduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush\nstatic call for flushing the branch predictors on JIT memory reuse.\nArchitectures that need a flush, can update it to a predictor flush\nfunction. By default, its a NOP and does not emit any CALL.\n\nAllocations larger than a pack are not covered by this flush. That is safe\nbecause cBPF programs (the unprivileged attack surface) are bounded well\nbelow a pack size. Issue a warning if this assumption is ever violated\nwhile the flush is active."}],"id":"CVE-2026-64508","lastModified":"2026-11-12T19:13:11.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T16:40:46.106500Z","version":"2.0.3"}}]},"published":"2026-07-25T10:17:36.920","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1fbafd5235ca897b322161659ebe8ba651b00b3b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e52c240c43a601b681e3a4e58fc5685114d4726"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a6c171c6a1ac6d1509752dac131d941a3de0b37"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ff183ee4d8c452960df58175a094828c0513b2e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/96cce16e26dd02a8678f1e87f88a4b5cdb63b995"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eed774da601268dae674e14d54a15e3624691f52"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64509.json b/data/2026/CVE-2026-64509.json index 475f2302b4..36f26ae763 100644 --- a/data/2026/CVE-2026-64509.json +++ b/data/2026/CVE-2026-64509.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["rust/kernel/block/mq/gen_disk.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb","status":"affected","version":"3253aba3408aa4eb2e4e09365eede3e63ef7536b","versionType":"git"},{"lessThan":"e7636f26f77070a529c26d65afd217514ce85ce4","status":"affected","version":"3253aba3408aa4eb2e4e09365eede3e63ef7536b","versionType":"git"},{"lessThan":"6822a2685b4da9a87efd1fce4b042678a31ff734","status":"affected","version":"3253aba3408aa4eb2e4e09365eede3e63ef7536b","versionType":"git"},{"lessThan":"2957771379fa335103a4b539db57bb2271e12142","status":"affected","version":"3253aba3408aa4eb2e4e09365eede3e63ef7536b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["rust/kernel/block/mq/gen_disk.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust: block: fix GenDisk cleanup paths\n\nGenDiskBuilder::build() still has fallible work after\n__blk_mq_alloc_disk(), but its error path only recovers the\nforeign queue data. That leaks the temporary gendisk and\nrequest_queue until later teardown. If the caller moved the last\nArc> into build(), the leaked queue can retain blk-mq\nstate after the tag set is dropped.\n\nFix the pre-registration failure path by dropping the temporary\ngendisk reference with put_disk() before recovering queue_data,\nso disk_release() can tear down the owned queue.\n\nAlso pair GenDisk::drop() with put_disk() after del_gendisk().\nOnce a Rust GenDisk has been added with device_add_disk(),\ndel_gendisk() only unregisters it; the final gendisk reference\nstill has to be dropped to complete the release path."}],"id":"CVE-2026-64509","lastModified":"2026-11-03T18:15:39.353","metrics":{},"published":"2026-07-25T10:17:37.030","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2957771379fa335103a4b539db57bb2271e12142"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6822a2685b4da9a87efd1fce4b042678a31ff734"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e7636f26f77070a529c26d65afd217514ce85ce4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["rust/kernel/block/mq/gen_disk.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb","status":"affected","version":"3253aba3408aa4eb2e4e09365eede3e63ef7536b","versionType":"git"},{"lessThan":"e7636f26f77070a529c26d65afd217514ce85ce4","status":"affected","version":"3253aba3408aa4eb2e4e09365eede3e63ef7536b","versionType":"git"},{"lessThan":"6822a2685b4da9a87efd1fce4b042678a31ff734","status":"affected","version":"3253aba3408aa4eb2e4e09365eede3e63ef7536b","versionType":"git"},{"lessThan":"2957771379fa335103a4b539db57bb2271e12142","status":"affected","version":"3253aba3408aa4eb2e4e09365eede3e63ef7536b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["rust/kernel/block/mq/gen_disk.rs"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6CA9DEFD-4FDD-406D-99A6-21AAF34980C2","versionEndExcluding":"6.12.97","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust: block: fix GenDisk cleanup paths\n\nGenDiskBuilder::build() still has fallible work after\n__blk_mq_alloc_disk(), but its error path only recovers the\nforeign queue data. That leaks the temporary gendisk and\nrequest_queue until later teardown. If the caller moved the last\nArc> into build(), the leaked queue can retain blk-mq\nstate after the tag set is dropped.\n\nFix the pre-registration failure path by dropping the temporary\ngendisk reference with put_disk() before recovering queue_data,\nso disk_release() can tear down the owned queue.\n\nAlso pair GenDisk::drop() with put_disk() after del_gendisk().\nOnce a Rust GenDisk has been added with device_add_disk(),\ndel_gendisk() only unregisters it; the final gendisk reference\nstill has to be dropped to complete the release path."}],"id":"CVE-2026-64509","lastModified":"2026-11-12T19:07:33.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-25T10:17:37.030","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2957771379fa335103a4b539db57bb2271e12142"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6822a2685b4da9a87efd1fce4b042678a31ff734"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e7636f26f77070a529c26d65afd217514ce85ce4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64511.json b/data/2026/CVE-2026-64511.json index 3df88b4561..4f89bb8dec 100644 --- a/data/2026/CVE-2026-64511.json +++ b/data/2026/CVE-2026-64511.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/acpi/nfit/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a44343fe230aa48c74ef09830f3c5c90848b257e","status":"affected","version":"9b311b7313d6c104dd4a2d43ab54536dce07f960","versionType":"git"},{"lessThan":"3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6","status":"affected","version":"9b311b7313d6c104dd4a2d43ab54536dce07f960","versionType":"git"},{"lessThan":"452945662fd8e9862a2d2043239c7ee1815d1ac4","status":"affected","version":"9b311b7313d6c104dd4a2d43ab54536dce07f960","versionType":"git"},{"lessThan":"873576e585da5d0fc5debbab74eed565c0acea99","status":"affected","version":"9b311b7313d6c104dd4a2d43ab54536dce07f960","versionType":"git"},{"lessThan":"027e128abb82788189d6d45b68e3e8e7329b67be","status":"affected","version":"9b311b7313d6c104dd4a2d43ab54536dce07f960","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/acpi/nfit/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: NFIT: core: Fix possible NULL pointer dereference\n\nAfter commit 9b311b7313d6 (\"ACPI: NFIT: Install Notify() handler before\ngetting NFIT table\"), acpi_nfit_probe() installs an ACPI notify handler\nfor the NFIT device before checking the presence of the NFIT table. If\nthat table is not there, 0 is returned without allocating the acpi_desc\nobject and setting the driver data pointer of the NFIT device. If the\nplatform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification\non the NFIT device at that point, acpi_nfit_uc_error_notify() will\ndereference a NULL pointer.\n\nPrevent that from occurring by adding an acpi_desc check against NULL\nto acpi_nfit_uc_error_notify()."}],"id":"CVE-2026-64511","lastModified":"2026-11-03T18:15:39.353","metrics":{},"published":"2026-07-25T10:17:37.273","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/027e128abb82788189d6d45b68e3e8e7329b67be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/452945662fd8e9862a2d2043239c7ee1815d1ac4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/873576e585da5d0fc5debbab74eed565c0acea99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a44343fe230aa48c74ef09830f3c5c90848b257e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/acpi/nfit/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a44343fe230aa48c74ef09830f3c5c90848b257e","status":"affected","version":"9b311b7313d6c104dd4a2d43ab54536dce07f960","versionType":"git"},{"lessThan":"3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6","status":"affected","version":"9b311b7313d6c104dd4a2d43ab54536dce07f960","versionType":"git"},{"lessThan":"452945662fd8e9862a2d2043239c7ee1815d1ac4","status":"affected","version":"9b311b7313d6c104dd4a2d43ab54536dce07f960","versionType":"git"},{"lessThan":"873576e585da5d0fc5debbab74eed565c0acea99","status":"affected","version":"9b311b7313d6c104dd4a2d43ab54536dce07f960","versionType":"git"},{"lessThan":"027e128abb82788189d6d45b68e3e8e7329b67be","status":"affected","version":"9b311b7313d6c104dd4a2d43ab54536dce07f960","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/acpi/nfit/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F3F015F2-570D-4553-96D0-72AFDDD74195","versionEndExcluding":"6.6.145","versionStartIncluding":"6.6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*","matchCriteriaId":"E346B162-D566-4E62-ABDE-ECBFB21B8BFD","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: NFIT: core: Fix possible NULL pointer dereference\n\nAfter commit 9b311b7313d6 (\"ACPI: NFIT: Install Notify() handler before\ngetting NFIT table\"), acpi_nfit_probe() installs an ACPI notify handler\nfor the NFIT device before checking the presence of the NFIT table. If\nthat table is not there, 0 is returned without allocating the acpi_desc\nobject and setting the driver data pointer of the NFIT device. If the\nplatform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification\non the NFIT device at that point, acpi_nfit_uc_error_notify() will\ndereference a NULL pointer.\n\nPrevent that from occurring by adding an acpi_desc check against NULL\nto acpi_nfit_uc_error_notify()."}],"id":"CVE-2026-64511","lastModified":"2026-11-12T19:04:35.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-07-25T10:17:37.273","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/027e128abb82788189d6d45b68e3e8e7329b67be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/452945662fd8e9862a2d2043239c7ee1815d1ac4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/873576e585da5d0fc5debbab74eed565c0acea99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a44343fe230aa48c74ef09830f3c5c90848b257e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64564.json b/data/2026/CVE-2026-64564.json index 7f5ddc7493..16d701a997 100644 --- a/data/2026/CVE-2026-64564.json +++ b/data/2026/CVE-2026-64564.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sctp/sm_make_chunk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"a63afa1f9b12d5293cbe0b77fd45dc0632533a13","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"2b324ba3494ae958cba16a453e3e71489b4de7fc","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"fedeb4468987bcaff85fe3061de5ae052d414740","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"74e8f3e7114f0e26d1b2c4c048044db9fcc27603","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"85aca407c560aba81b5ce9d3d6cf94c74077d19b","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"d136b29bf91dd8e3161281b87de597b7311d9462","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"9b2854f86f0b56e9027d68e7a3fc909d1a9b566f","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sctp/sm_make_chunk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.25"},{"lessThan":"2.6.25","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: don't free the ASCONF's own transport in DEL-IP processing\n\nsctp_process_asconf() caches the transport the ASCONF chunk is processed\nagainst in asconf->transport (== chunk->transport, set once in sctp_rcv()).\nFor an ASCONF located through its Address Parameter by\n__sctp_rcv_asconf_lookup(), that cached transport corresponds to the\nAddress Parameter, which need not be the packet's source address.\n\nsctp_process_asconf_param() rejects a DEL-IP for the packet source address\n(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.\nA single ASCONF can therefore carry, in order:\n\n [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]\n\nwhere L differs from the source. The DEL-IP for L passes the D8 check and\ncalls sctp_assoc_rm_peer() on the transport that asconf->transport still\npoints at, freeing it (RCU-deferred). The following wildcard DEL-IP then\nreuses the now-dangling asconf->transport in sctp_assoc_set_primary() and\nsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed\ntransport (->ipaddr, ->state) and plants the dangling pointer into\nasoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping\nonly the pointer that is no longer on the list, removes every real\ntransport, leaving the association with a transport_count of 0 and\nprimary_path/active_path pointing at freed memory.\n\nReject a DEL-IP that targets the transport the ASCONF is being processed\nagainst, mirroring the existing source-address guard, so the wildcard\nbranch can never reuse a freed transport."}],"id":"CVE-2026-64564","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64564","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:57.454548Z","version":"2.0.3"}}]},"published":"2026-08-04T07:16:31.340","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2b324ba3494ae958cba16a453e3e71489b4de7fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/74e8f3e7114f0e26d1b2c4c048044db9fcc27603"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/85aca407c560aba81b5ce9d3d6cf94c74077d19b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9b2854f86f0b56e9027d68e7a3fc909d1a9b566f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a63afa1f9b12d5293cbe0b77fd45dc0632533a13"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d136b29bf91dd8e3161281b87de597b7311d9462"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fedeb4468987bcaff85fe3061de5ae052d414740"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/08/06/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/08/06/3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/08/06/4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/08/07/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/08/07/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/08/07/8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sctp/sm_make_chunk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"a63afa1f9b12d5293cbe0b77fd45dc0632533a13","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"2b324ba3494ae958cba16a453e3e71489b4de7fc","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"fedeb4468987bcaff85fe3061de5ae052d414740","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"74e8f3e7114f0e26d1b2c4c048044db9fcc27603","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"85aca407c560aba81b5ce9d3d6cf94c74077d19b","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"d136b29bf91dd8e3161281b87de597b7311d9462","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"},{"lessThan":"9b2854f86f0b56e9027d68e7a3fc909d1a9b566f","status":"affected","version":"42e30bf3463cd37d73839376662cb79b4d5c416c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sctp/sm_make_chunk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.25"},{"lessThan":"2.6.25","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"27243D27-8665-4635-AFA2-201880F1FEA8","versionEndExcluding":"5.10.265","versionStartIncluding":"2.6.25","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E53EBB9F-3754-42D9-9B1B-A16E73848ED3","versionEndExcluding":"5.15.216","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"621B79C8-2F65-4565-991D-62AAE146B524","versionEndExcluding":"6.1.183","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6391AD0C-FE0C-4D09-8ACA-C9F7979254AE","versionEndExcluding":"6.6.148","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A4402C34-0450-4C2E-B4BF-63320A4A4FF9","versionEndExcluding":"6.12.101","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1CD263AE-3BD4-43F3-AF24-6BA22541E0C2","versionEndExcluding":"6.18.42","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D275C711-FF65-4C57-BA4D-CD9B5D7BF0A3","versionEndExcluding":"7.1.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*","matchCriteriaId":"D6ECA620-8606-4230-A87D-3FF3EFE12592","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc4:*:*:*:*:*:*","matchCriteriaId":"8FAEA5EF-B1E7-4023-9E7A-90DE11D91F2B","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: don't free the ASCONF's own transport in DEL-IP processing\n\nsctp_process_asconf() caches the transport the ASCONF chunk is processed\nagainst in asconf->transport (== chunk->transport, set once in sctp_rcv()).\nFor an ASCONF located through its Address Parameter by\n__sctp_rcv_asconf_lookup(), that cached transport corresponds to the\nAddress Parameter, which need not be the packet's source address.\n\nsctp_process_asconf_param() rejects a DEL-IP for the packet source address\n(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.\nA single ASCONF can therefore carry, in order:\n\n [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]\n\nwhere L differs from the source. The DEL-IP for L passes the D8 check and\ncalls sctp_assoc_rm_peer() on the transport that asconf->transport still\npoints at, freeing it (RCU-deferred). The following wildcard DEL-IP then\nreuses the now-dangling asconf->transport in sctp_assoc_set_primary() and\nsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed\ntransport (->ipaddr, ->state) and plants the dangling pointer into\nasoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping\nonly the pointer that is no longer on the list, removes every real\ntransport, leaving the association with a transport_count of 0 and\nprimary_path/active_path pointing at freed memory.\n\nReject a DEL-IP that targets the transport the ASCONF is being processed\nagainst, mirroring the existing source-address guard, so the wildcard\nbranch can never reuse a freed transport."}],"id":"CVE-2026-64564","lastModified":"2026-11-12T20:15:01.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64564","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:57.454548Z","version":"2.0.3"}}]},"published":"2026-08-04T07:16:31.340","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b324ba3494ae958cba16a453e3e71489b4de7fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/74e8f3e7114f0e26d1b2c4c048044db9fcc27603"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/85aca407c560aba81b5ce9d3d6cf94c74077d19b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b2854f86f0b56e9027d68e7a3fc909d1a9b566f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a63afa1f9b12d5293cbe0b77fd45dc0632533a13"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d136b29bf91dd8e3161281b87de597b7311d9462"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fedeb4468987bcaff85fe3061de5ae052d414740"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Exploit","Third Party Advisory"],"url":"https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/08/06/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/08/06/3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/08/06/4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/08/07/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/08/07/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/08/07/8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64567.json b/data/2026/CVE-2026-64567.json index 45a43b8ae9..9a9428a19e 100644 --- a/data/2026/CVE-2026-64567.json +++ b/data/2026/CVE-2026-64567.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/free-space-cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8ded74c654a982dc8581a17b0caa7fcedb20de69","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"c9c38066b6446e83668c041702bb639b0ca49363","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"094734c7aaa2b36751dc32480a680a4952685e78","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"33878ba25e2638bc0c61623d7a05c9ca2b74c039","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"5e1b2ca6b34939e70fb0785e8222b53cf060016f","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"f9fef131fa3f59b857217f522fa5ea430d1b707c","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"a2d8d5647ed854e38f941741aea45b9eb15a6350","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/free-space-cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject free space cache with more entries than pages\n\nWhen loading a v1 free space cache, __load_free_space_cache() takes\nnum_entries and num_bitmaps straight from the on-disk\nbtrfs_free_space_header. That header is stored in the tree_root under a key\nwith type 0, which the tree-checker has no case for, so neither count is\nvalidated before the load trusts it.\n\nThe load loops num_entries times and maps the next page whenever the current\none runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which\ndoes io_ctl->pages[io_ctl->index++]. But pages[] is allocated in\nio_ctl_init() from the cache inode's i_size, not from num_entries:\n\n\tnum_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);\n\tio_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);\n\nSo if num_entries claims more records than the pages can hold, io_ctl->index\nruns off the end of pages[]. The write side never hits this because\nio_ctl_add_entry() and io_ctl_add_bitmap() both stop once\nio_ctl->index >= io_ctl->num_pages; the read side just never had the same\ncheck.\n\nTo trigger it, take a clean cache (num_entries = here), set num_entries\nin the header to 0x10000, and fix up the leaf checksum so it still passes\nthe tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and\npages[] is a 16-pointer (kmalloc-128) array. The load now tries to read\n65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the\narray:\n\n BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58\n io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)\n load_free_space_cache (fs/btrfs/free-space-cache.c:1017)\n caching_thread (fs/btrfs/block-group.c:880)\n btrfs_work_helper (fs/btrfs/async-thread.c:312)\n process_one_work\n worker_thread\n kthread\n ret_from_fork\n\nfree-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc()\nat line 565, which is why that is the frame KASAN names. The out-of-bounds\nslot is then treated as a struct page and handed to crc32c(), so the bad\nread turns into a GP fault.\n\nAdd the missing check to io_ctl_check_crc(), which is where both the entry\nloop and the bitmap loop end up. When num_entries is too large the load now\nfails like any corrupt cache: __load_free_space_cache() drops it and rebuilds\nthe free space from the extent tree, so a valid cache is never rejected."}],"id":"CVE-2026-64567","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64567","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:59.944567Z","version":"2.0.3"}}]},"published":"2026-08-05T08:16:36.277","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/094734c7aaa2b36751dc32480a680a4952685e78"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/33878ba25e2638bc0c61623d7a05c9ca2b74c039"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5e1b2ca6b34939e70fb0785e8222b53cf060016f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8ded74c654a982dc8581a17b0caa7fcedb20de69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a2d8d5647ed854e38f941741aea45b9eb15a6350"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c9c38066b6446e83668c041702bb639b0ca49363"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f9fef131fa3f59b857217f522fa5ea430d1b707c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/free-space-cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8ded74c654a982dc8581a17b0caa7fcedb20de69","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"c9c38066b6446e83668c041702bb639b0ca49363","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"094734c7aaa2b36751dc32480a680a4952685e78","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"33878ba25e2638bc0c61623d7a05c9ca2b74c039","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"5e1b2ca6b34939e70fb0785e8222b53cf060016f","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"f9fef131fa3f59b857217f522fa5ea430d1b707c","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"},{"lessThan":"a2d8d5647ed854e38f941741aea45b9eb15a6350","status":"affected","version":"5b0e95bf607ddd59b39f52d3d55e6581c817b530","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/free-space-cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E1F8C506-3731-4BED-AEC3-F1DA55764F3B","versionEndExcluding":"5.10.265","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E53EBB9F-3754-42D9-9B1B-A16E73848ED3","versionEndExcluding":"5.15.216","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"621B79C8-2F65-4565-991D-62AAE146B524","versionEndExcluding":"6.1.183","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6391AD0C-FE0C-4D09-8ACA-C9F7979254AE","versionEndExcluding":"6.6.148","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A4402C34-0450-4C2E-B4BF-63320A4A4FF9","versionEndExcluding":"6.12.101","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1CD263AE-3BD4-43F3-AF24-6BA22541E0C2","versionEndExcluding":"6.18.42","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D275C711-FF65-4C57-BA4D-CD9B5D7BF0A3","versionEndExcluding":"7.1.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*","matchCriteriaId":"D6ECA620-8606-4230-A87D-3FF3EFE12592","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject free space cache with more entries than pages\n\nWhen loading a v1 free space cache, __load_free_space_cache() takes\nnum_entries and num_bitmaps straight from the on-disk\nbtrfs_free_space_header. That header is stored in the tree_root under a key\nwith type 0, which the tree-checker has no case for, so neither count is\nvalidated before the load trusts it.\n\nThe load loops num_entries times and maps the next page whenever the current\none runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which\ndoes io_ctl->pages[io_ctl->index++]. But pages[] is allocated in\nio_ctl_init() from the cache inode's i_size, not from num_entries:\n\n\tnum_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);\n\tio_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);\n\nSo if num_entries claims more records than the pages can hold, io_ctl->index\nruns off the end of pages[]. The write side never hits this because\nio_ctl_add_entry() and io_ctl_add_bitmap() both stop once\nio_ctl->index >= io_ctl->num_pages; the read side just never had the same\ncheck.\n\nTo trigger it, take a clean cache (num_entries = here), set num_entries\nin the header to 0x10000, and fix up the leaf checksum so it still passes\nthe tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and\npages[] is a 16-pointer (kmalloc-128) array. The load now tries to read\n65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the\narray:\n\n BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58\n io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)\n load_free_space_cache (fs/btrfs/free-space-cache.c:1017)\n caching_thread (fs/btrfs/block-group.c:880)\n btrfs_work_helper (fs/btrfs/async-thread.c:312)\n process_one_work\n worker_thread\n kthread\n ret_from_fork\n\nfree-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc()\nat line 565, which is why that is the frame KASAN names. The out-of-bounds\nslot is then treated as a struct page and handed to crc32c(), so the bad\nread turns into a GP fault.\n\nAdd the missing check to io_ctl_check_crc(), which is where both the entry\nloop and the bitmap loop end up. When num_entries is too large the load now\nfails like any corrupt cache: __load_free_space_cache() drops it and rebuilds\nthe free space from the extent tree, so a valid cache is never rejected."}],"id":"CVE-2026-64567","lastModified":"2026-11-12T19:58:33.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64567","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:59.944567Z","version":"2.0.3"}}]},"published":"2026-08-05T08:16:36.277","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/094734c7aaa2b36751dc32480a680a4952685e78"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33878ba25e2638bc0c61623d7a05c9ca2b74c039"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e1b2ca6b34939e70fb0785e8222b53cf060016f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ded74c654a982dc8581a17b0caa7fcedb20de69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a2d8d5647ed854e38f941741aea45b9eb15a6350"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c9c38066b6446e83668c041702bb639b0ca49363"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f9fef131fa3f59b857217f522fa5ea430d1b707c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64570.json b/data/2026/CVE-2026-64570.json index eae3aa8b17..50c2fcb121 100644 --- a/data/2026/CVE-2026-64570.json +++ b/data/2026/CVE-2026-64570.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/mac80211/cfg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e2c55079155a953db669ca1986a985fa286bad95","status":"affected","version":"3b1c256eb4aedfc71dd97d5951ccff824b41d628","versionType":"git"},{"lessThan":"5baaa1042f71dd4b8e418f2cdd516808702d229b","status":"affected","version":"3b1c256eb4aedfc71dd97d5951ccff824b41d628","versionType":"git"},{"lessThan":"1981fba71797ec95e6755fb882cad88899a2a84f","status":"affected","version":"3b1c256eb4aedfc71dd97d5951ccff824b41d628","versionType":"git"},{"lessThan":"286e52a799fa158bdbd77da1426c4d93f9a6e7ad","status":"affected","version":"3b1c256eb4aedfc71dd97d5951ccff824b41d628","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/mac80211/cfg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix fils_discovery double free on alloc failure\n\nieee80211_set_fils_discovery() calls kfree_rcu() on the old template\nbefore allocating the replacement. If the kzalloc() then fails, it\nreturns -ENOMEM while link->u.ap.fils_discovery still points at the\nobject already queued for freeing. A later update or AP teardown\n(ieee80211_stop_ap()) re-queues that same rcu_head; the second free is\ncaught by KASAN when the RCU sheaf is processed in softirq:\n\n BUG: KASAN: double-free in rcu_free_sheaf (mm/slub.c:5850)\n Free of addr ffff88800c065280 by task swapper/0/0\n ...\n __rcu_free_sheaf_prepare (mm/slub.c:2634 mm/slub.c:2940)\n rcu_free_sheaf (mm/slub.c:5850)\n rcu_core (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869)\n handle_softirqs (kernel/softirq.c:622)\n The buggy address belongs to the cache kmalloc-96 of size 96\n\nQueue the old object for kfree_rcu() only after the new one is published,\nmatching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon()."}],"id":"CVE-2026-64570","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:43:03.870353Z","version":"2.0.3"}}]},"published":"2026-08-05T08:16:36.680","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1981fba71797ec95e6755fb882cad88899a2a84f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/286e52a799fa158bdbd77da1426c4d93f9a6e7ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5baaa1042f71dd4b8e418f2cdd516808702d229b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e2c55079155a953db669ca1986a985fa286bad95"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/mac80211/cfg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e2c55079155a953db669ca1986a985fa286bad95","status":"affected","version":"3b1c256eb4aedfc71dd97d5951ccff824b41d628","versionType":"git"},{"lessThan":"5baaa1042f71dd4b8e418f2cdd516808702d229b","status":"affected","version":"3b1c256eb4aedfc71dd97d5951ccff824b41d628","versionType":"git"},{"lessThan":"1981fba71797ec95e6755fb882cad88899a2a84f","status":"affected","version":"3b1c256eb4aedfc71dd97d5951ccff824b41d628","versionType":"git"},{"lessThan":"286e52a799fa158bdbd77da1426c4d93f9a6e7ad","status":"affected","version":"3b1c256eb4aedfc71dd97d5951ccff824b41d628","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/mac80211/cfg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A4402C34-0450-4C2E-B4BF-63320A4A4FF9","versionEndExcluding":"6.12.101","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1CD263AE-3BD4-43F3-AF24-6BA22541E0C2","versionEndExcluding":"6.18.42","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D275C711-FF65-4C57-BA4D-CD9B5D7BF0A3","versionEndExcluding":"7.1.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*","matchCriteriaId":"D6ECA620-8606-4230-A87D-3FF3EFE12592","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix fils_discovery double free on alloc failure\n\nieee80211_set_fils_discovery() calls kfree_rcu() on the old template\nbefore allocating the replacement. If the kzalloc() then fails, it\nreturns -ENOMEM while link->u.ap.fils_discovery still points at the\nobject already queued for freeing. A later update or AP teardown\n(ieee80211_stop_ap()) re-queues that same rcu_head; the second free is\ncaught by KASAN when the RCU sheaf is processed in softirq:\n\n BUG: KASAN: double-free in rcu_free_sheaf (mm/slub.c:5850)\n Free of addr ffff88800c065280 by task swapper/0/0\n ...\n __rcu_free_sheaf_prepare (mm/slub.c:2634 mm/slub.c:2940)\n rcu_free_sheaf (mm/slub.c:5850)\n rcu_core (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869)\n handle_softirqs (kernel/softirq.c:622)\n The buggy address belongs to the cache kmalloc-96 of size 96\n\nQueue the old object for kfree_rcu() only after the new one is published,\nmatching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon()."}],"id":"CVE-2026-64570","lastModified":"2026-11-12T19:56:43.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:43:03.870353Z","version":"2.0.3"}}]},"published":"2026-08-05T08:16:36.680","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1981fba71797ec95e6755fb882cad88899a2a84f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/286e52a799fa158bdbd77da1426c4d93f9a6e7ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5baaa1042f71dd4b8e418f2cdd516808702d229b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2c55079155a953db669ca1986a985fa286bad95"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-6460.json b/data/2026/CVE-2026-6460.json index 48417e2dd6..eba264ea12 100644 --- a/data/2026/CVE-2026-6460.json +++ b/data/2026/CVE-2026-6460.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as \"ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN\". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-6460","lastModified":"2026-11-12T15:17:51.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:51.597","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-6460/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as \"ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN\". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-6460","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:51.597","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-6460/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64666.json b/data/2026/CVE-2026-64666.json index d6cca2e576..ced50d2804 100644 --- a/data/2026/CVE-2026-64666.json +++ b/data/2026/CVE-2026-64666.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"pam_usb","vendor":"mcdope","versions":[{"status":"affected","version":"< 0.9.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3."}],"id":"CVE-2026-64666","lastModified":"2026-11-11T05:19:50.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:50.700","references":[{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/issues/410"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/pull/417"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"pam_usb","vendor":"mcdope","versions":[{"status":"affected","version":"< 0.9.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3."}],"id":"CVE-2026-64666","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:50.700","references":[{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/issues/410"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/pull/417"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64667.json b/data/2026/CVE-2026-64667.json index cf0a7c3186..478bbfe74a 100644 --- a/data/2026/CVE-2026-64667.json +++ b/data/2026/CVE-2026-64667.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"pam_usb","vendor":"mcdope","versions":[{"status":"affected","version":"< 0.9.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3."}],"id":"CVE-2026-64667","lastModified":"2026-11-11T05:19:50.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:50.893","references":[{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/commit/d0a2e716241304cdb069adfaf54d2ede629d57fa"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/issues/411"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/pull/426"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-gc6f-5hpq-ghxh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"pam_usb","vendor":"mcdope","versions":[{"status":"affected","version":"< 0.9.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read(2) returns exactly 4096 bytes for any process the function inspects, the buffer ends without a terminator and the subsequent strstr() calls scan past the allocation boundary. The function is invoked during normal PAM authentication when DISPLAY is set, so the read fires for every process at auth time. Consequences are bounded: strstr output is a Boolean substring match (limited info-disclosure surface) but a hostile heap layout can produce a SIGSEGV that terminates the host PAM process. This issue has been patched in version 0.9.3."}],"id":"CVE-2026-64667","lastModified":"2026-11-12T20:18:49.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64667","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:32:47.813653Z","version":"2.0.3"}}]},"published":"2026-11-11T05:19:50.893","references":[{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/commit/d0a2e716241304cdb069adfaf54d2ede629d57fa"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/issues/411"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/pull/426"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-gc6f-5hpq-ghxh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64668.json b/data/2026/CVE-2026-64668.json index 70b80a0e9e..9637a49d48 100644 --- a/data/2026/CVE-2026-64668.json +++ b/data/2026/CVE-2026-64668.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"pam_usb","vendor":"mcdope","versions":[{"status":"affected","version":">= 0.8.0, < 0.9.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection pattern matched the address group and then immediately expected whitespace. On Linux systems with multi-homed network interfaces, w -i appends a zone index (scope identifier) to link-local IPv6 addresses — e.g. fe80::1%eth0. The %eth0 suffix appeared between the address and the next whitespace field, causing the regex match to fail even for an otherwise-matching remote session. The function returned \"no remote clients\" and granted access. This issue has been patched in version 0.9.3."}],"id":"CVE-2026-64668","lastModified":"2026-11-11T05:19:51.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:51.113","references":[{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/pull/423"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-7583-9cqv-j9rf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"pam_usb","vendor":"mcdope","versions":[{"status":"affected","version":">= 0.8.0, < 0.9.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection pattern matched the address group and then immediately expected whitespace. On Linux systems with multi-homed network interfaces, w -i appends a zone index (scope identifier) to link-local IPv6 addresses — e.g. fe80::1%eth0. The %eth0 suffix appeared between the address and the next whitespace field, causing the regex match to fail even for an otherwise-matching remote session. The function returned \"no remote clients\" and granted access. This issue has been patched in version 0.9.3."}],"id":"CVE-2026-64668","lastModified":"2026-11-12T18:17:51.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64668","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:31:06.158569Z","version":"2.0.3"}}]},"published":"2026-11-11T05:19:51.113","references":[{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/pull/423"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-7583-9cqv-j9rf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64669.json b/data/2026/CVE-2026-64669.json index aa7bcc5342..c465b6b3b0 100644 --- a/data/2026/CVE-2026-64669.json +++ b/data/2026/CVE-2026-64669.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"pam_usb","vendor":"mcdope","versions":[{"status":"affected","version":">= 0.8.0, < 0.9.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection regex required exactly four explicit colon-separated groups of 1-4 hex digits (e.g. 2001:0db8:85a3:0000). Any IPv6 address in compressed notation — including loopback (::1), link-local (fe80::1), and global unicast addresses (2001:db8::1) — did not match this pattern. As a result the remote-client check silently returned \"no remote clients\" even when a remote tmux client was connected from such an address. This issue has been patched in version 0.9.3."}],"id":"CVE-2026-64669","lastModified":"2026-11-11T05:19:51.327","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:51.327","references":[{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/pull/423"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-gc4c-v52c-2v34"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"pam_usb","vendor":"mcdope","versions":[{"status":"affected","version":">= 0.8.0, < 0.9.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tmux_has_remote_clients() (src/tmux.c), the IPv6 detection regex required exactly four explicit colon-separated groups of 1-4 hex digits (e.g. 2001:0db8:85a3:0000). Any IPv6 address in compressed notation — including loopback (::1), link-local (fe80::1), and global unicast addresses (2001:db8::1) — did not match this pattern. As a result the remote-client check silently returned \"no remote clients\" even when a remote tmux client was connected from such an address. This issue has been patched in version 0.9.3."}],"id":"CVE-2026-64669","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:51.327","references":[{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/commit/a62513f3da871d6576d751de3482eb80b9ac79f3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/pull/423"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-gc4c-v52c-2v34"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-6467.json b/data/2026/CVE-2026-6467.json index e825049cde..7c3b398339 100644 --- a/data/2026/CVE-2026-6467.json +++ b/data/2026/CVE-2026-6467.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA \"$user\". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-6467","lastModified":"2026-11-12T15:17:51.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:51.793","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-6467/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA \"$user\". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-6467","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:51.793","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-6467/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64670.json b/data/2026/CVE-2026-64670.json index 7901840b06..bec1d1ac3d 100644 --- a/data/2026/CVE-2026-64670.json +++ b/data/2026/CVE-2026-64670.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"waline","vendor":"walinejs","versions":[{"status":"affected","version":"<= 3.15.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches."}],"id":"CVE-2026-64670","lastModified":"2026-11-11T05:19:51.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:51.527","references":[{"source":"security-advisories@github.com","url":"https://github.com/walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"waline","vendor":"walinejs","versions":[{"status":"affected","version":"<= 3.15.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches."}],"id":"CVE-2026-64670","lastModified":"2026-11-12T20:18:49.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64670","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:31:49.794803Z","version":"2.0.3"}}]},"published":"2026-11-11T05:19:51.527","references":[{"source":"security-advisories@github.com","url":"https://github.com/walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64671.json b/data/2026/CVE-2026-64671.json index 02279efa04..36e06fd24f 100644 --- a/data/2026/CVE-2026-64671.json +++ b/data/2026/CVE-2026-64671.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"waline","vendor":"walinejs","versions":[{"status":"affected","version":"<= 3.15.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by the server (only the comment body is sanitized), and the link field is never sent to the spam filter. So an unauthenticated visitor who posts a comment with link = x\"> achieves stored cross-site scripting that executes, with no interaction, in the browser of every visitor to a page that embeds the UserList widget. At time of publication, there are no publicly available patches."}],"id":"CVE-2026-64671","lastModified":"2026-11-11T05:19:51.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:51.733","references":[{"source":"security-advisories@github.com","url":"https://github.com/walinejs/waline/security/advisories/GHSA-7w94-hxwm-gg99"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"waline","vendor":"walinejs","versions":[{"status":"affected","version":"<= 3.15.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by the server (only the comment body is sanitized), and the link field is never sent to the spam filter. So an unauthenticated visitor who posts a comment with link = x\"> achieves stored cross-site scripting that executes, with no interaction, in the browser of every visitor to a page that embeds the UserList widget. At time of publication, there are no publicly available patches."}],"id":"CVE-2026-64671","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:51.733","references":[{"source":"security-advisories@github.com","url":"https://github.com/walinejs/waline/security/advisories/GHSA-7w94-hxwm-gg99"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-64672.json b/data/2026/CVE-2026-64672.json index c6e51e75c0..0c3ac19230 100644 --- a/data/2026/CVE-2026-64672.json +++ b/data/2026/CVE-2026-64672.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"terragrunt","vendor":"gruntwork-io","versions":[{"status":"affected","version":"< 1.1.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1."}],"id":"CVE-2026-64672","lastModified":"2026-11-07T04:17:34.123","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64672","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:32:07.167352Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:42.893","references":[{"source":"security-advisories@github.com","url":"https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a"},{"source":"security-advisories@github.com","url":"https://github.com/gruntwork-io/terragrunt/pull/6438"},{"source":"security-advisories@github.com","url":"https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1"},{"source":"security-advisories@github.com","url":"https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-377"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"terragrunt","vendor":"gruntwork-io","versions":[{"status":"affected","version":"< 1.1.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1."}],"id":"CVE-2026-64672","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64672","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:32:07.167352Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:42.893","references":[{"source":"security-advisories@github.com","url":"https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a"},{"source":"security-advisories@github.com","url":"https://github.com/gruntwork-io/terragrunt/pull/6438"},{"source":"security-advisories@github.com","url":"https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1"},{"source":"security-advisories@github.com","url":"https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-377"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64678.json b/data/2026/CVE-2026-64678.json index 6e6a442a89..91ce598bb1 100644 --- a/data/2026/CVE-2026-64678.json +++ b/data/2026/CVE-2026-64678.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"nitrite-java","vendor":"nitrite","versions":[{"status":"affected","version":"< 4.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() — solely to remap a handful of known legacy class names to their current equivalents — and implements no class allowlist, blocklist, or ObjectInputFilter (JEP 290). Any Serializable class reachable on the embedding application's classpath can therefore be instantiated via readObject(), with readObject()/readExternal()/readResolve() callbacks invoked unconditionally. If a suitable gadget class (e.g. from commons-collections or similar) happens to be present on the classpath, this is a precondition for remote code execution. This issue has been patched in version 4.4.1."}],"id":"CVE-2026-64678","lastModified":"2026-11-11T05:19:51.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:51.937","references":[{"source":"security-advisories@github.com","url":"https://github.com/nitrite/nitrite-java/releases/tag/v4.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/nitrite/nitrite-java/security/advisories/GHSA-9297-g93h-86gg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"nitrite-java","vendor":"nitrite","versions":[{"status":"affected","version":"< 4.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() — solely to remap a handful of known legacy class names to their current equivalents — and implements no class allowlist, blocklist, or ObjectInputFilter (JEP 290). Any Serializable class reachable on the embedding application's classpath can therefore be instantiated via readObject(), with readObject()/readExternal()/readResolve() callbacks invoked unconditionally. If a suitable gadget class (e.g. from commons-collections or similar) happens to be present on the classpath, this is a precondition for remote code execution. This issue has been patched in version 4.4.1."}],"id":"CVE-2026-64678","lastModified":"2026-11-12T20:18:49.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64678","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:30:09.186924Z","version":"2.0.3"}}]},"published":"2026-11-11T05:19:51.937","references":[{"source":"security-advisories@github.com","url":"https://github.com/nitrite/nitrite-java/releases/tag/v4.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/nitrite/nitrite-java/security/advisories/GHSA-9297-g93h-86gg"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nitrite/nitrite-java/security/advisories/GHSA-9297-g93h-86gg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64682.json b/data/2026/CVE-2026-64682.json index bc15112771..a25a5a6761 100644 --- a/data/2026/CVE-2026-64682.json +++ b/data/2026/CVE-2026-64682.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"astro-blocks","vendor":"NauelG","versions":[{"status":"affected","version":"< 3.4.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: \"owner\" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0."}],"id":"CVE-2026-64682","lastModified":"2026-11-11T05:19:52.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:52.120","references":[{"source":"security-advisories@github.com","url":"https://github.com/NauelG/astro-blocks/commit/fd83bf0b37a756363f718e134c16e448da09a74d"},{"source":"security-advisories@github.com","url":"https://github.com/NauelG/astro-blocks/pull/51"},{"source":"security-advisories@github.com","url":"https://github.com/NauelG/astro-blocks/releases/tag/v3.4.0"},{"source":"security-advisories@github.com","url":"https://github.com/NauelG/astro-blocks/security/advisories/GHSA-mfcg-m7j5-7v72"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"},{"lang":"en","value":"CWE-798"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"astro-blocks","vendor":"NauelG","versions":[{"status":"affected","version":"< 3.4.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: \"owner\" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0."}],"id":"CVE-2026-64682","lastModified":"2026-11-12T18:17:51.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64682","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:53:25.534762Z","version":"2.0.3"}}]},"published":"2026-11-11T05:19:52.120","references":[{"source":"security-advisories@github.com","url":"https://github.com/NauelG/astro-blocks/commit/fd83bf0b37a756363f718e134c16e448da09a74d"},{"source":"security-advisories@github.com","url":"https://github.com/NauelG/astro-blocks/pull/51"},{"source":"security-advisories@github.com","url":"https://github.com/NauelG/astro-blocks/releases/tag/v3.4.0"},{"source":"security-advisories@github.com","url":"https://github.com/NauelG/astro-blocks/security/advisories/GHSA-mfcg-m7j5-7v72"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"},{"lang":"en","value":"CWE-798"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64855.json b/data/2026/CVE-2026-64855.json index 7872b65936..b0d6de8a00 100644 --- a/data/2026/CVE-2026-64855.json +++ b/data/2026/CVE-2026-64855.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"soapbar","vendor":"hitoshyamamoto","versions":[{"status":"affected","version":"< 0.13.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's not-before / not-after dates, and then verified the signature against that same certificate. There was no CA-chain validation, no issuer/subject allowlist, and no pinning. A successful verify_envelope_bsp() therefore proved only that the envelope was signed by whoever supplied the embedded certificate — never that it was signed by a trusted party. An attacker who mints their own certificate, signs a forged envelope, and embeds that certificate in the token passes verification. Any consumer that treats a successful BSP verification as authentication can be impersonated (signature forgery / authentication bypass). verify_envelope() (which pins a caller-supplied x509_cert) was not affected — the flaw was specific to the BSP variant whose trust anchor came from the message. This issue has been patched in version 0.13.0."}],"id":"CVE-2026-64855","lastModified":"2026-11-11T16:17:25.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T16:17:25.370","references":[{"source":"security-advisories@github.com","url":"https://github.com/hitoshyamamoto/soapbar/pull/71"},{"source":"security-advisories@github.com","url":"https://github.com/hitoshyamamoto/soapbar/releases/tag/v0.13.0"},{"source":"security-advisories@github.com","url":"https://github.com/hitoshyamamoto/soapbar/security/advisories/GHSA-859w-52fx-hcm6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-347"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"soapbar","vendor":"hitoshyamamoto","versions":[{"status":"affected","version":"< 0.13.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's not-before / not-after dates, and then verified the signature against that same certificate. There was no CA-chain validation, no issuer/subject allowlist, and no pinning. A successful verify_envelope_bsp() therefore proved only that the envelope was signed by whoever supplied the embedded certificate — never that it was signed by a trusted party. An attacker who mints their own certificate, signs a forged envelope, and embeds that certificate in the token passes verification. Any consumer that treats a successful BSP verification as authentication can be impersonated (signature forgery / authentication bypass). verify_envelope() (which pins a caller-supplied x509_cert) was not affected — the flaw was specific to the BSP variant whose trust anchor came from the message. This issue has been patched in version 0.13.0."}],"id":"CVE-2026-64855","lastModified":"2026-11-12T20:18:50.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64855","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:35:40.490316Z","version":"2.0.3"}}]},"published":"2026-11-11T16:17:25.370","references":[{"source":"security-advisories@github.com","url":"https://github.com/hitoshyamamoto/soapbar/pull/71"},{"source":"security-advisories@github.com","url":"https://github.com/hitoshyamamoto/soapbar/releases/tag/v0.13.0"},{"source":"security-advisories@github.com","url":"https://github.com/hitoshyamamoto/soapbar/security/advisories/GHSA-859w-52fx-hcm6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-347"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-64861.json b/data/2026/CVE-2026-64861.json index db1493e8c3..2c28bdecc5 100644 --- a/data/2026/CVE-2026-64861.json +++ b/data/2026/CVE-2026-64861.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"probo","vendor":"getprobo","versions":[{"status":"affected","version":"< 0.222.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0."}],"id":"CVE-2026-64861","lastModified":"2026-11-11T19:17:43.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T19:17:43.453","references":[{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/commit/bf255b198cb6c9f44cd183c49743c9ffdaa44ce7"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/pull/1424"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.222.0"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/security/advisories/GHSA-prh2-g8pv-m7p9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"probo","vendor":"getprobo","versions":[{"status":"affected","version":"< 0.222.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0."}],"id":"CVE-2026-64861","lastModified":"2026-11-12T18:17:51.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64861","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:11.907498Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:43.453","references":[{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/commit/bf255b198cb6c9f44cd183c49743c9ffdaa44ce7"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/pull/1424"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.222.0"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/security/advisories/GHSA-prh2-g8pv-m7p9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-65820.json b/data/2026/CVE-2026-65820.json index 6416c316db..9fd000f347 100644 --- a/data/2026/CVE-2026-65820.json +++ b/data/2026/CVE-2026-65820.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"aeon","vendor":"aeon-toolkit","versions":[{"status":"affected","version":"< 1.5.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pull_request_target for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged context. The vulnerable workflow also generated/used elevated credentials and could automatically commit or push fixes back to pull request branches. This created a potential token exposure and repository write path if an attacker submitted a malicious fork pull request designed to execute during the privileged workflow run. This issue has been patched in version 1.5.0."}],"id":"CVE-2026-65820","lastModified":"2026-11-11T18:19:47.940","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T18:19:47.940","references":[{"source":"security-advisories@github.com","url":"https://github.com/aeon-toolkit/aeon/commit/99261e1355c89a316bf0824bb03f855c6aadae8f"},{"source":"security-advisories@github.com","url":"https://github.com/aeon-toolkit/aeon/pull/3394"},{"source":"security-advisories@github.com","url":"https://github.com/aeon-toolkit/aeon/security/advisories/GHSA-mhg2-mc45-wrjr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"aeon","vendor":"aeon-toolkit","versions":[{"status":"affected","version":"< 1.5.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pull_request_target for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged context. The vulnerable workflow also generated/used elevated credentials and could automatically commit or push fixes back to pull request branches. This created a potential token exposure and repository write path if an attacker submitted a malicious fork pull request designed to execute during the privileged workflow run. This issue has been patched in version 1.5.0."}],"id":"CVE-2026-65820","lastModified":"2026-11-12T20:18:50.443","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-65820","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:36:44.193480Z","version":"2.0.3"}}]},"published":"2026-11-11T18:19:47.940","references":[{"source":"security-advisories@github.com","url":"https://github.com/aeon-toolkit/aeon/commit/99261e1355c89a316bf0824bb03f855c6aadae8f"},{"source":"security-advisories@github.com","url":"https://github.com/aeon-toolkit/aeon/pull/3394"},{"source":"security-advisories@github.com","url":"https://github.com/aeon-toolkit/aeon/security/advisories/GHSA-mhg2-mc45-wrjr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-65840.json b/data/2026/CVE-2026-65840.json index 60a1e1fb0d..4c088699f8 100644 --- a/data/2026/CVE-2026-65840.json +++ b/data/2026/CVE-2026-65840.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"fider","vendor":"getfider","versions":[{"status":"affected","version":"< 0.36.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0."}],"id":"CVE-2026-65840","lastModified":"2026-11-11T19:17:43.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T19:17:43.937","references":[{"source":"security-advisories@github.com","url":"https://github.com/getfider/fider/releases/tag/v0.36.0"},{"source":"security-advisories@github.com","url":"https://github.com/getfider/fider/security/advisories/GHSA-vxjw-gv4f-vq58"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"fider","vendor":"getfider","versions":[{"status":"affected","version":"< 0.36.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0."}],"id":"CVE-2026-65840","lastModified":"2026-11-12T18:17:52.093","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-65840","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:31:15.248085Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:43.937","references":[{"source":"security-advisories@github.com","url":"https://github.com/getfider/fider/releases/tag/v0.36.0"},{"source":"security-advisories@github.com","url":"https://github.com/getfider/fider/security/advisories/GHSA-vxjw-gv4f-vq58"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-65957.json b/data/2026/CVE-2026-65957.json index 05bf853feb..eb845c5512 100644 --- a/data/2026/CVE-2026-65957.json +++ b/data/2026/CVE-2026-65957.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"helio","vendor":"gethelio","versions":[{"status":"affected","version":"< 0.8.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0."}],"id":"CVE-2026-65957","lastModified":"2026-11-11T21:16:46.243","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:46.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/commit/4ca8329c38b0edbc5e4d782a4e3b0cfc5cd7782e"},{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/pull/121"},{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/releases/tag/v0.8.0"},{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/security/advisories/GHSA-2c3r-q7gv-hp2m"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-942"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"helio","vendor":"gethelio","versions":[{"status":"affected","version":"< 0.8.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0."}],"id":"CVE-2026-65957","lastModified":"2026-11-12T18:17:52.263","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-65957","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:10.952541Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:46.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/commit/4ca8329c38b0edbc5e4d782a4e3b0cfc5cd7782e"},{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/pull/121"},{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/releases/tag/v0.8.0"},{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/security/advisories/GHSA-2c3r-q7gv-hp2m"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-942"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-65967.json b/data/2026/CVE-2026-65967.json index 2ea9ccc6b0..e8a8eb7adc 100644 --- a/data/2026/CVE-2026-65967.json +++ b/data/2026/CVE-2026-65967.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"fider","vendor":"getfider","versions":[{"status":"affected","version":"< 0.34.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0."}],"id":"CVE-2026-65967","lastModified":"2026-11-11T19:17:44.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T19:17:44.287","references":[{"source":"security-advisories@github.com","url":"https://github.com/getfider/fider/releases/tag/v0.34.0"},{"source":"security-advisories@github.com","url":"https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"fider","vendor":"getfider","versions":[{"status":"affected","version":"< 0.34.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0."}],"id":"CVE-2026-65967","lastModified":"2026-11-12T20:18:51.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-65967","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:37:46.515516Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:44.287","references":[{"source":"security-advisories@github.com","url":"https://github.com/getfider/fider/releases/tag/v0.34.0"},{"source":"security-advisories@github.com","url":"https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-65982.json b/data/2026/CVE-2026-65982.json index 230ff4b6bb..7af1875dc8 100644 --- a/data/2026/CVE-2026-65982.json +++ b/data/2026/CVE-2026-65982.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"nginx-http-flv-module","vendor":"winshining","versions":[{"status":"affected","version":"< 1.2.14"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-module used r->headers_in.host->value to make a pseudo tcUrl, so NULL-pointer dereference happened. This issue has been patched in version 1.2.14."}],"id":"CVE-2026-65982","lastModified":"2026-11-11T21:16:46.903","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:46.903","references":[{"source":"security-advisories@github.com","url":"https://github.com/winshining/nginx-http-flv-module/security/advisories/GHSA-8mc6-jrxv-29g9"},{"source":"security-advisories@github.com","url":"https://www.chtsecurity.com/news/b15d7b24-0a5e-4962-8b52-e4754e5af4f8?lang=en"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"nginx-http-flv-module","vendor":"winshining","versions":[{"status":"affected","version":"< 1.2.14"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-module used r->headers_in.host->value to make a pseudo tcUrl, so NULL-pointer dereference happened. This issue has been patched in version 1.2.14."}],"id":"CVE-2026-65982","lastModified":"2026-11-12T18:17:52.447","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-65982","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:13.537754Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:46.903","references":[{"source":"security-advisories@github.com","url":"https://github.com/winshining/nginx-http-flv-module/security/advisories/GHSA-8mc6-jrxv-29g9"},{"source":"security-advisories@github.com","url":"https://www.chtsecurity.com/news/b15d7b24-0a5e-4962-8b52-e4754e5af4f8?lang=en"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-66293.json b/data/2026/CVE-2026-66293.json index bd02ac2ae3..e7236350ad 100644 --- a/data/2026/CVE-2026-66293.json +++ b/data/2026/CVE-2026-66293.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Saxy'","'Elixir.Saxy.Encoder'","'Elixir.Saxy.XML'"],"packageName":"saxy","packageURL":"pkg:hex/saxy","product":"saxy","programFiles":["lib/saxy.ex","lib/saxy/encoder.ex","lib/saxy/xml.ex"],"programRoutines":[{"name":"'Elixir.Saxy':encode!/2"},{"name":"'Elixir.Saxy':encode_to_iodata!/2"},{"name":"'Elixir.Saxy.XML':comment/1"}],"repo":"https://github.com/qcam/saxy","vendor":"qcam","versions":[{"lessThan":"1.7.0","status":"affected","version":"0.7.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Saxy'","'Elixir.Saxy.Encoder'","'Elixir.Saxy.XML'"],"packageName":"qcam/saxy","packageURL":"pkg:github/qcam/saxy","product":"saxy","programFiles":["lib/saxy.ex","lib/saxy/encoder.ex","lib/saxy/xml.ex"],"programRoutines":[{"name":"'Elixir.Saxy':encode!/2"},{"name":"'Elixir.Saxy':encode_to_iodata!/2"},{"name":"'Elixir.Saxy.XML':comment/1"}],"repo":"https://github.com/qcam/saxy","vendor":"qcam","versions":[{"lessThan":"6d12ee12b9e32e86ef598b3f3cafccd1840b2f41","status":"affected","version":"7266632e9407842f28ffac254c56dc41210a5690","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the delimiters.\n\nWhen an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.\n\nThis issue affects saxy: from 0.7.0 before 1.7.0."}],"id":"CVE-2026-66293","lastModified":"2026-11-10T18:17:45.970","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-66293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:42:07.677044Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:16.057","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-66293.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-66293"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Saxy'","'Elixir.Saxy.Encoder'","'Elixir.Saxy.XML'"],"packageName":"saxy","packageURL":"pkg:hex/saxy","product":"saxy","programFiles":["lib/saxy.ex","lib/saxy/encoder.ex","lib/saxy/xml.ex"],"programRoutines":[{"name":"'Elixir.Saxy':encode!/2"},{"name":"'Elixir.Saxy':encode_to_iodata!/2"},{"name":"'Elixir.Saxy.XML':comment/1"}],"repo":"https://github.com/qcam/saxy","vendor":"qcam","versions":[{"lessThan":"1.7.0","status":"affected","version":"0.7.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Saxy'","'Elixir.Saxy.Encoder'","'Elixir.Saxy.XML'"],"packageName":"qcam/saxy","packageURL":"pkg:github/qcam/saxy","product":"saxy","programFiles":["lib/saxy.ex","lib/saxy/encoder.ex","lib/saxy/xml.ex"],"programRoutines":[{"name":"'Elixir.Saxy':encode!/2"},{"name":"'Elixir.Saxy':encode_to_iodata!/2"},{"name":"'Elixir.Saxy.XML':comment/1"}],"repo":"https://github.com/qcam/saxy","vendor":"qcam","versions":[{"lessThan":"6d12ee12b9e32e86ef598b3f3cafccd1840b2f41","status":"affected","version":"7266632e9407842f28ffac254c56dc41210a5690","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the delimiters.\n\nWhen an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.\n\nThis issue affects saxy: from 0.7.0 before 1.7.0."}],"id":"CVE-2026-66293","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-66293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:42:07.677044Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:16.057","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-66293.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-66293"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-66294.json b/data/2026/CVE-2026-66294.json index c85cda31a0..1d923f0929 100644 --- a/data/2026/CVE-2026-66294.json +++ b/data/2026/CVE-2026-66294.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Saxy'","'Elixir.Saxy.Encoder'","'Elixir.Saxy.XML'"],"packageName":"saxy","packageURL":"pkg:hex/saxy","product":"saxy","programFiles":["lib/saxy.ex","lib/saxy/encoder.ex","lib/saxy/xml.ex"],"programRoutines":[{"name":"'Elixir.Saxy':encode!/2"},{"name":"'Elixir.Saxy':encode_to_iodata!/2"},{"name":"'Elixir.Saxy.Encoder':encode_to_iodata/2"},{"name":"'Elixir.Saxy.Encoder':cdata/1"},{"name":"'Elixir.Saxy.XML':cdata/1"}],"repo":"https://github.com/qcam/saxy","vendor":"qcam","versions":[{"lessThan":"1.7.0","status":"affected","version":"0.7.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Saxy'","'Elixir.Saxy.Encoder'","'Elixir.Saxy.XML'"],"packageName":"qcam/saxy","packageURL":"pkg:github/qcam/saxy","product":"saxy","programFiles":["lib/saxy.ex","lib/saxy/encoder.ex","lib/saxy/xml.ex"],"programRoutines":[{"name":"'Elixir.Saxy':encode!/2"},{"name":"'Elixir.Saxy':encode_to_iodata!/2"},{"name":"'Elixir.Saxy.Encoder':encode_to_iodata/2"},{"name":"'Elixir.Saxy.Encoder':cdata/1"},{"name":"'Elixir.Saxy.XML':cdata/1"}],"repo":"https://github.com/qcam/saxy","vendor":"qcam","versions":[{"lessThan":"71d99fae12f1d6596f5edb57b71f26ba854f4d33","status":"affected","version":"7266632e9407842f28ffac254c56dc41210a5690","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters <, >, &, \", and ', but the CDATA path applies no neutralization at all. XML provides no character escaping mechanism inside a CDATA section, so the only correct way to represent a ]]> substring is to split the section and rejoin it as ]]]]>. Saxy neither performs that split nor rejects the substring.\n\nAn application that renders untrusted text as CDATA, by building the node with Saxy.XML.cdata/1 and serializing it with Saxy.encode!/2 or Saxy.encode_to_iodata!/2, therefore lets an attacker terminate the section at a position of their choosing. Everything supplied after the ]]> is emitted outside any CDATA context and is parsed as markup, so a single attacker-controlled text field becomes attacker-controlled document structure: arbitrary sibling elements and attributes that the application never built. Downstream consumers of the serialized document accept the injected markup as genuine. Services that generate SOAP envelopes, RSS or Atom feeds, sitemaps, SVG, or XML exports from user-supplied content can have trusted fields forged or overridden. Applications that never place untrusted text in a CDATA node are not affected.\n\nThis issue affects saxy: from 0.7.0 before 1.7.0."}],"id":"CVE-2026-66294","lastModified":"2026-11-10T18:17:46.240","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-66294","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:43:23.760979Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:16.317","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-66294.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/commit/71d99fae12f1d6596f5edb57b71f26ba854f4d33"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/security/advisories/GHSA-hq6g-j46w-wx72"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-66294"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Saxy'","'Elixir.Saxy.Encoder'","'Elixir.Saxy.XML'"],"packageName":"saxy","packageURL":"pkg:hex/saxy","product":"saxy","programFiles":["lib/saxy.ex","lib/saxy/encoder.ex","lib/saxy/xml.ex"],"programRoutines":[{"name":"'Elixir.Saxy':encode!/2"},{"name":"'Elixir.Saxy':encode_to_iodata!/2"},{"name":"'Elixir.Saxy.Encoder':encode_to_iodata/2"},{"name":"'Elixir.Saxy.Encoder':cdata/1"},{"name":"'Elixir.Saxy.XML':cdata/1"}],"repo":"https://github.com/qcam/saxy","vendor":"qcam","versions":[{"lessThan":"1.7.0","status":"affected","version":"0.7.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Saxy'","'Elixir.Saxy.Encoder'","'Elixir.Saxy.XML'"],"packageName":"qcam/saxy","packageURL":"pkg:github/qcam/saxy","product":"saxy","programFiles":["lib/saxy.ex","lib/saxy/encoder.ex","lib/saxy/xml.ex"],"programRoutines":[{"name":"'Elixir.Saxy':encode!/2"},{"name":"'Elixir.Saxy':encode_to_iodata!/2"},{"name":"'Elixir.Saxy.Encoder':encode_to_iodata/2"},{"name":"'Elixir.Saxy.Encoder':cdata/1"},{"name":"'Elixir.Saxy.XML':cdata/1"}],"repo":"https://github.com/qcam/saxy","vendor":"qcam","versions":[{"lessThan":"71d99fae12f1d6596f5edb57b71f26ba854f4d33","status":"affected","version":"7266632e9407842f28ffac254c56dc41210a5690","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters <, >, &, \", and ', but the CDATA path applies no neutralization at all. XML provides no character escaping mechanism inside a CDATA section, so the only correct way to represent a ]]> substring is to split the section and rejoin it as ]]]]>. Saxy neither performs that split nor rejects the substring.\n\nAn application that renders untrusted text as CDATA, by building the node with Saxy.XML.cdata/1 and serializing it with Saxy.encode!/2 or Saxy.encode_to_iodata!/2, therefore lets an attacker terminate the section at a position of their choosing. Everything supplied after the ]]> is emitted outside any CDATA context and is parsed as markup, so a single attacker-controlled text field becomes attacker-controlled document structure: arbitrary sibling elements and attributes that the application never built. Downstream consumers of the serialized document accept the injected markup as genuine. Services that generate SOAP envelopes, RSS or Atom feeds, sitemaps, SVG, or XML exports from user-supplied content can have trusted fields forged or overridden. Applications that never place untrusted text in a CDATA node are not affected.\n\nThis issue affects saxy: from 0.7.0 before 1.7.0."}],"id":"CVE-2026-66294","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-66294","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:43:23.760979Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:16.317","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-66294.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/commit/71d99fae12f1d6596f5edb57b71f26ba854f4d33"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/qcam/saxy/security/advisories/GHSA-hq6g-j46w-wx72"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-66294"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-66295.json b/data/2026/CVE-2026-66295.json index e8aee23f23..618377c25d 100644 --- a/data/2026/CVE-2026-66295.json +++ b/data/2026/CVE-2026-66295.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Saxy'","'Elixir.Saxy.Encoder'","'Elixir.Saxy.XML'"],"packageName":"saxy","packageURL":"pkg:hex/saxy","product":"saxy","programFiles":["lib/saxy.ex","lib/saxy/encoder.ex","lib/saxy/xml.ex"],"programRoutines":[{"name":"'Elixir.Saxy':encode!/2"},{"name":"'Elixir.Saxy':encode_to_iodata!/2"},{"name":"'Elixir.Saxy.Encoder':encode_to_iodata/2"},{"name":"'Elixir.Saxy.XML':processing_instruction/2"}],"repo":"https://github.com/qcam/saxy","vendor":"qcam","versions":[{"lessThan":"1.7.0","status":"affected","version":"0.7.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Saxy'","'Elixir.Saxy.Encoder'","'Elixir.Saxy.XML'"],"packageName":"qcam/saxy","packageURL":"pkg:github/qcam/saxy","product":"saxy","programFiles":["lib/saxy.ex","lib/saxy/encoder.ex","lib/saxy/xml.ex"],"programRoutines":[{"name":"'Elixir.Saxy':encode!/2"},{"name":"'Elixir.Saxy':encode_to_iodata!/2"},{"name":"'Elixir.Saxy.Encoder':encode_to_iodata/2"},{"name":"'Elixir.Saxy.XML':processing_instruction/2"}],"repo":"https://github.com/qcam/saxy","vendor":"qcam","versions":[{"lessThan":"4aeb80e2acc318f57bd7453ad2eafd59101a90e0","status":"affected","version":"7266632e9407842f28ffac254c56dc41210a5690","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between , so neither field is checked against the constraints the XML specification places on it.\n\nBecause ?> terminates a processing instruction, a target or content value containing that sequence closes the construct at a position the attacker chooses. Everything the attacker writes after it is emitted as ordinary markup at document level, which allows arbitrary elements, attributes, and further processing instructions to be injected into the serialized document. Appending a matching , so neither field is checked against the constraints the XML specification places on it.\n\nBecause ?> terminates a processing instruction, a target or content value containing that sequence closes the construct at a position the attacker chooses. Everything the attacker writes after it is emitted as ordinary markup at document level, which allows arbitrary elements, attributes, and further processing instructions to be injected into the serialized document. Appending a matching = 0.4.4, < 0.29.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0."}],"id":"CVE-2026-68539","lastModified":"2026-11-11T22:17:30.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:30.480","references":[{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/pull/582"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/pull/584"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"fulgur","vendor":"fulgur-rs","versions":[{"status":"affected","version":">= 0.4.4, < 0.29.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0."}],"id":"CVE-2026-68539","lastModified":"2026-11-12T18:17:53.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68539","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:15.767584Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:30.480","references":[{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/pull/582"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/pull/584"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-68548.json b/data/2026/CVE-2026-68548.json new file mode 100644 index 0000000000..78ca65b8fe --- /dev/null +++ b/data/2026/CVE-2026-68548.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"algernon","vendor":"xyproto","versions":[{"status":"affected","version":"< 1.17.10"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10."}],"id":"CVE-2026-68548","lastModified":"2026-11-12T20:18:51.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:51.307","references":[{"source":"security-advisories@github.com","url":"https://github.com/xyproto/algernon/releases/tag/v1.17.10"},{"source":"security-advisories@github.com","url":"https://github.com/xyproto/algernon/security/advisories/GHSA-vm84-8c4p-64hx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-178"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-68588.json b/data/2026/CVE-2026-68588.json index 589705713c..7a6ce919fa 100644 --- a/data/2026/CVE-2026-68588.json +++ b/data/2026/CVE-2026-68588.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01334054 / MOLY01312486; Issue ID: MSV-7920."}],"id":"CVE-2026-68588","lastModified":"2026-11-02T16:18:52.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T14:54:11.769551Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.950","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01334054 / MOLY01312486; Issue ID: MSV-7920."}],"id":"CVE-2026-68588","lastModified":"2026-11-12T16:53:55.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T14:54:11.769551Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:37.950","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-68589.json b/data/2026/CVE-2026-68589.json index 2409ee6f63..5fc1a715a7 100644 --- a/data/2026/CVE-2026-68589.json +++ b/data/2026/CVE-2026-68589.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01320076; Issue ID: MSV-6889."}],"id":"CVE-2026-68589","lastModified":"2026-11-03T05:18:51.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:38.087","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01320076; Issue ID: MSV-6889."}],"id":"CVE-2026-68589","lastModified":"2026-11-12T16:53:46.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:38.087","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-68590.json b/data/2026/CVE-2026-68590.json index 676447769b..c816c7ced8 100644 --- a/data/2026/CVE-2026-68590.json +++ b/data/2026/CVE-2026-68590.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01387180; Issue ID: MSV-5152."}],"id":"CVE-2026-68590","lastModified":"2026-11-02T16:18:52.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T14:47:53.654708Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:38.213","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2716"},{"status":"affected","version":"MT2735"},{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6833"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6853"},{"status":"affected","version":"MT6855"},{"status":"affected","version":"MT6858"},{"status":"affected","version":"MT6873"},{"status":"affected","version":"MT6875"},{"status":"affected","version":"MT6877"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6880"},{"status":"affected","version":"MT6881"},{"status":"affected","version":"MT6883"},{"status":"affected","version":"MT6885"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6889"},{"status":"affected","version":"MT6890"},{"status":"affected","version":"MT6891"},{"status":"affected","version":"MT6893"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6899"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6982"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6986"},{"status":"affected","version":"MT6988"},{"status":"affected","version":"MT6989"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT6991"},{"status":"affected","version":"MT6993"},{"status":"affected","version":"MT8668"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8678"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8771"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8791"},{"status":"affected","version":"MT8791T"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8793"},{"status":"affected","version":"MT8796"},{"status":"affected","version":"MT8797"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8875"},{"status":"affected","version":"MT8883"},{"status":"affected","version":"MT8893"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01387180; Issue ID: MSV-5152."}],"id":"CVE-2026-68590","lastModified":"2026-11-12T16:53:34.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T14:47:53.654708Z","version":"2.0.3"}}]},"published":"2026-11-02T03:17:38.213","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-68591.json b/data/2026/CVE-2026-68591.json index 655b93fde2..cc66231604 100644 --- a/data/2026/CVE-2026-68591.json +++ b/data/2026/CVE-2026-68591.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958."}],"id":"CVE-2026-68591","lastModified":"2026-11-03T05:18:52.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:38.343","references":[{"source":"security@mediatek.com","url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"security@mediatek.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MediaTek chipset","vendor":"MediaTek, Inc.","versions":[{"status":"affected","version":"MT2737"},{"status":"affected","version":"MT6813"},{"status":"affected","version":"MT6815"},{"status":"affected","version":"MT6835"},{"status":"affected","version":"MT6878"},{"status":"affected","version":"MT6879"},{"status":"affected","version":"MT6886"},{"status":"affected","version":"MT6895"},{"status":"affected","version":"MT6896"},{"status":"affected","version":"MT6897"},{"status":"affected","version":"MT6980"},{"status":"affected","version":"MT6983"},{"status":"affected","version":"MT6985"},{"status":"affected","version":"MT6990"},{"status":"affected","version":"MT8676"},{"status":"affected","version":"MT8755"},{"status":"affected","version":"MT8775"},{"status":"affected","version":"MT8792"},{"status":"affected","version":"MT8798"},{"status":"affected","version":"MT8863"},{"status":"affected","version":"MT8873"},{"status":"affected","version":"MT8883"}]}],"source":"security@mediatek.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958."}],"id":"CVE-2026-68591","lastModified":"2026-11-12T16:53:25.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-02T03:17:38.343","references":[{"source":"security@mediatek.com","tags":["Vendor Advisory"],"url":"https://www.mediatek.com/product-security-bulletin/November-2026"}],"sourceIdentifier":"security@mediatek.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"security@mediatek.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-68862.json b/data/2026/CVE-2026-68862.json index 21898d930f..560f72297c 100644 --- a/data/2026/CVE-2026-68862.json +++ b/data/2026/CVE-2026-68862.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for Dell PowerFlex","vendor":"Dell","versions":[{"lessThan":"1.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform Provider for Dell PowerFlex contain(s) an OS Command Injection Vulnerability in the SDC host provisioning component. A high privileged remote attacker with access to the PowerFlex management plane could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on provisioned SDC hosts. Exploitation may lead to full compromise of affected SDC hosts."}],"id":"CVE-2026-68862","lastModified":"2026-11-11T18:19:49.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:49.170","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for Dell PowerFlex","vendor":"Dell","versions":[{"lessThan":"1.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform Provider for Dell PowerFlex contain(s) an OS Command Injection Vulnerability in the SDC host provisioning component. A high privileged remote attacker with access to the PowerFlex management plane could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on provisioned SDC hosts. Exploitation may lead to full compromise of affected SDC hosts."}],"id":"CVE-2026-68862","lastModified":"2026-11-12T20:18:51.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68862","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:37:10.371403Z","version":"2.0.3"}}]},"published":"2026-11-11T18:19:49.170","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-70642.json b/data/2026/CVE-2026-70642.json index cbb526495b..9e314ab0ae 100644 --- a/data/2026/CVE-2026-70642.json +++ b/data/2026/CVE-2026-70642.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ToolJet/ToolJet","product":"ToolJet","repo":"https://github.com/ToolJet/ToolJet","vendor":"ToolJet","versions":[{"lessThan":"3.21.94","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editing_version_id from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization."}],"id":"CVE-2026-70642","lastModified":"2026-11-12T16:19:13.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T16:19:13.593","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/ToolJet/ToolJet/commit/e5f387a0e6fd8c9627d3e12418a2ae33a00b08d0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/ToolJet/ToolJet/pull/18137"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tooljet-authorization-bypass-via-app-environments-init"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ToolJet/ToolJet","product":"ToolJet","repo":"https://github.com/ToolJet/ToolJet","vendor":"ToolJet","versions":[{"lessThan":"3.21.94","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editing_version_id from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization."}],"id":"CVE-2026-70642","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T16:19:13.593","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/ToolJet/ToolJet/commit/e5f387a0e6fd8c9627d3e12418a2ae33a00b08d0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/ToolJet/ToolJet/pull/18137"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tooljet-authorization-bypass-via-app-environments-init"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-70659.json b/data/2026/CVE-2026-70659.json index 138ba4d062..4ba5af3122 100644 --- a/data/2026/CVE-2026-70659.json +++ b/data/2026/CVE-2026-70659.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"stable-diffusion.cpp","vendor":"leejet","versions":[{"status":"affected","version":"< master-763-4fcc6fe"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only when they are empty. An untrusted .imatrix file can provide a small nval for the first entry and a larger nval for a second entry with the same name, causing the accumulation loop to write attacker-controlled floating-point and integer values beyond both heap buffers. Loading the file through the --imat-in conversion path can corrupt the heap or crash the process before a model is required. This issue is fixed in master-763-4fcc6fe."}],"id":"CVE-2026-70659","lastModified":"2026-11-09T17:17:32.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-70659","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:12:12.004034Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:48.047","references":[{"source":"security-advisories@github.com","url":"https://github.com/leejet/stable-diffusion.cpp/commit/4fcc6fef10c6f686801c6e257b22cd6a3deb906b"},{"source":"security-advisories@github.com","url":"https://github.com/leejet/stable-diffusion.cpp/pull/1750"},{"source":"security-advisories@github.com","url":"https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-763-4fcc6fe"},{"source":"security-advisories@github.com","url":"https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-6q7q-2v9c-x8m7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"},{"lang":"en","value":"CWE-1284"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"stable-diffusion.cpp","vendor":"leejet","versions":[{"status":"affected","version":"< master-763-4fcc6fe"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only when they are empty. An untrusted .imatrix file can provide a small nval for the first entry and a larger nval for a second entry with the same name, causing the accumulation loop to write attacker-controlled floating-point and integer values beyond both heap buffers. Loading the file through the --imat-in conversion path can corrupt the heap or crash the process before a model is required. This issue is fixed in master-763-4fcc6fe."}],"id":"CVE-2026-70659","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-70659","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:12:12.004034Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:48.047","references":[{"source":"security-advisories@github.com","url":"https://github.com/leejet/stable-diffusion.cpp/commit/4fcc6fef10c6f686801c6e257b22cd6a3deb906b"},{"source":"security-advisories@github.com","url":"https://github.com/leejet/stable-diffusion.cpp/pull/1750"},{"source":"security-advisories@github.com","url":"https://github.com/leejet/stable-diffusion.cpp/releases/tag/master-763-4fcc6fe"},{"source":"security-advisories@github.com","url":"https://github.com/leejet/stable-diffusion.cpp/security/advisories/GHSA-6q7q-2v9c-x8m7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"},{"lang":"en","value":"CWE-1284"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-71363.json b/data/2026/CVE-2026-71363.json new file mode 100644 index 0000000000..35c7487750 --- /dev/null +++ b/data/2026/CVE-2026-71363.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/controller-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/controller-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"automation-controller","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability."}],"id":"CVE-2026-71363","lastModified":"2026-11-12T18:17:53.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T18:17:53.270","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-71363"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511899"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-71395.json b/data/2026/CVE-2026-71395.json index f50af0273e..dd6824600a 100644 --- a/data/2026/CVE-2026-71395.json +++ b/data/2026/CVE-2026-71395.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:fop-core","packageURL":"pkg:maven/org.apache.xmlgraphics/fop-core","product":"Apache XML Graphics FOP","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.11.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue."}],"id":"CVE-2026-71395","lastModified":"2026-11-11T19:17:44.443","metrics":{},"published":"2026-11-11T15:17:24.763","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/FOP-3332"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/nsb89to1r0vzdh3t4w7x10q4z3xk5jqf"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/19"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:fop-core","packageURL":"pkg:maven/org.apache.xmlgraphics/fop-core","product":"Apache XML Graphics FOP","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.11.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.\n\n\n\nThis issue affects Apache XML Graphics FOP: through 2.11.\n\n\n\nUsers are recommended to upgrade to version 2.12, which fixes the issue."}],"id":"CVE-2026-71395","lastModified":"2026-11-12T17:01:06.913","metrics":{},"published":"2026-11-11T15:17:24.763","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/FOP-3332"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/nsb89to1r0vzdh3t4w7x10q4z3xk5jqf"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/19"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-71397.json b/data/2026/CVE-2026-71397.json index 0e4cf9a8f0..226eee9a47 100644 --- a/data/2026/CVE-2026-71397.json +++ b/data/2026/CVE-2026-71397.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server.Adapters.Cowboy.Handler'","'Elixir.GRPC.Server.Adapters.Cowboy'"],"packageName":"grpc_server","packageURL":"pkg:hex/grpc_server","product":"grpc_server","programFiles":["lib/grpc/server/adapters/cowboy/handler.ex","lib/grpc/server/adapters/cowboy.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"1.0.6","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server.Adapters.Cowboy.Handler'","'Elixir.GRPC.Server.Adapters.Cowboy'"],"packageName":"elixir-grpc/grpc","packageURL":"pkg:github/elixir-grpc/grpc","product":"grpc_server","programFiles":["grpc_server/lib/grpc/server/adapters/cowboy/handler.ex","grpc_server/lib/grpc/server/adapters/cowboy.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"0b663ca53dbf0f36f7f67ff1d0026f4482a18915","status":"affected","version":"49e18c3ec6bb9afe2f712caad3dbab5c56a68a00","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.\n\nThe streaming read clause of 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. 'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.\n\nThis issue affects grpc_server: from 1.0.0 before 1.0.6."}],"id":"CVE-2026-71397","lastModified":"2026-11-10T15:17:29.443","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-71397","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:16:42.568773Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:10.480","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-71397.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/0b663ca53dbf0f36f7f67ff1d0026f4482a18915"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-vx6q-cr5q-945g"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-71397"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-vx6q-cr5q-945g"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server.Adapters.Cowboy.Handler'","'Elixir.GRPC.Server.Adapters.Cowboy'"],"packageName":"grpc_server","packageURL":"pkg:hex/grpc_server","product":"grpc_server","programFiles":["lib/grpc/server/adapters/cowboy/handler.ex","lib/grpc/server/adapters/cowboy.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"1.0.6","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server.Adapters.Cowboy.Handler'","'Elixir.GRPC.Server.Adapters.Cowboy'"],"packageName":"elixir-grpc/grpc","packageURL":"pkg:github/elixir-grpc/grpc","product":"grpc_server","programFiles":["grpc_server/lib/grpc/server/adapters/cowboy/handler.ex","grpc_server/lib/grpc/server/adapters/cowboy.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"0b663ca53dbf0f36f7f67ff1d0026f4482a18915","status":"affected","version":"49e18c3ec6bb9afe2f712caad3dbab5c56a68a00","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body.\n\nThe streaming read clause of 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) never checks the configured max_body_size. Only the unary read path enforces that cap. 'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex) appends every received chunk to its buffer until a complete length-prefixed message arrives. A client can declare a very large message and send it across many small HTTP/2 DATA frames, and the server buffers all of it.\n\nThis issue affects grpc_server: from 1.0.0 before 1.0.6."}],"id":"CVE-2026-71397","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-71397","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:16:42.568773Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:10.480","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-71397.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/0b663ca53dbf0f36f7f67ff1d0026f4482a18915"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-vx6q-cr5q-945g"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-71397"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-vx6q-cr5q-945g"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-71881.json b/data/2026/CVE-2026-71881.json index 1f3e058daf..84b70e8364 100644 --- a/data/2026/CVE-2026-71881.json +++ b/data/2026/CVE-2026-71881.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Integrated Publishing Toolkit","vendor":"GBIF","versions":[{"lessThan":"3.3.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"mandiant-cve@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting"}],"id":"CVE-2026-71881","lastModified":"2026-11-10T14:17:36.157","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"mandiant-cve@google.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-71881","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:13:45.517079Z","version":"2.0.3"}}]},"published":"2026-11-07T00:16:58.577","references":[{"source":"mandiant-cve@google.com","url":"https://github.com/gbif/ipt/issues/3166"},{"source":"mandiant-cve@google.com","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0017.md"}],"sourceIdentifier":"mandiant-cve@google.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"mandiant-cve@google.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Integrated Publishing Toolkit","vendor":"GBIF","versions":[{"lessThan":"3.3.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"mandiant-cve@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting"}],"id":"CVE-2026-71881","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"mandiant-cve@google.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-71881","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:13:45.517079Z","version":"2.0.3"}}]},"published":"2026-11-07T00:16:58.577","references":[{"source":"mandiant-cve@google.com","url":"https://github.com/gbif/ipt/issues/3166"},{"source":"mandiant-cve@google.com","url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0017.md"}],"sourceIdentifier":"mandiant-cve@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"mandiant-cve@google.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-74850.json b/data/2026/CVE-2026-74850.json index 994dc4fa01..6663126867 100644 --- a/data/2026/CVE-2026-74850.json +++ b/data/2026/CVE-2026-74850.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files."}],"id":"CVE-2026-74850","lastModified":"2026-11-12T04:17:19.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.890","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files."}],"id":"CVE-2026-74850","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:19.890","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-74857.json b/data/2026/CVE-2026-74857.json index 5a749599d4..c9dcde2149 100644 --- a/data/2026/CVE-2026-74857.json +++ b/data/2026/CVE-2026-74857.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-74857","lastModified":"2026-11-12T04:17:20.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.040","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-304"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-74857","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.040","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-304"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-75590.json b/data/2026/CVE-2026-75590.json index 2e9673f6c1..95f5bf2642 100644 --- a/data/2026/CVE-2026-75590.json +++ b/data/2026/CVE-2026-75590.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses."}],"id":"CVE-2026-75590","lastModified":"2026-11-07T05:19:01.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.7,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:19:01.820","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses."}],"id":"CVE-2026-75590","lastModified":"2026-11-12T19:17:05.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.7,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-75590","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:54:24.824207Z","version":"2.0.3"}}]},"published":"2026-11-07T05:19:01.820","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295635"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-75598.json b/data/2026/CVE-2026-75598.json index d1bc87126d..a24b033fd3 100644 --- a/data/2026/CVE-2026-75598.json +++ b/data/2026/CVE-2026-75598.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"shadow","vendor":"GradleUp","versions":[{"status":"affected","version":"< 9.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved when the applicable archive-processing path does not reject them. Some affected Shadow implementations process dependency archives directly, so upgrading Gradle alone does not universally prevent this behavior. If the resulting archive is extracted without path traversal protection, attacker-controlled files can be written outside the intended destination. This issue is fixed in version 9.6.0."}],"id":"CVE-2026-75598","lastModified":"2026-11-09T13:17:08.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-75598","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T13:11:46.327900Z","version":"2.0.3"}}]},"published":"2026-11-06T18:18:18.880","references":[{"source":"security-advisories@github.com","url":"https://github.com/GradleUp/shadow/commit/0c2744fcc050e34a084f5131d5e167b13c342bfd"},{"source":"security-advisories@github.com","url":"https://github.com/GradleUp/shadow/releases/tag/9.6.0"},{"source":"security-advisories@github.com","url":"https://github.com/GradleUp/shadow/security/advisories/GHSA-rr8v-fxxf-c986"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/GradleUp/shadow/security/advisories/GHSA-rr8v-fxxf-c986"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"shadow","vendor":"GradleUp","versions":[{"status":"affected","version":"< 9.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved when the applicable archive-processing path does not reject them. Some affected Shadow implementations process dependency archives directly, so upgrading Gradle alone does not universally prevent this behavior. If the resulting archive is extracted without path traversal protection, attacker-controlled files can be written outside the intended destination. This issue is fixed in version 9.6.0."}],"id":"CVE-2026-75598","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-75598","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T13:11:46.327900Z","version":"2.0.3"}}]},"published":"2026-11-06T18:18:18.880","references":[{"source":"security-advisories@github.com","url":"https://github.com/GradleUp/shadow/commit/0c2744fcc050e34a084f5131d5e167b13c342bfd"},{"source":"security-advisories@github.com","url":"https://github.com/GradleUp/shadow/releases/tag/9.6.0"},{"source":"security-advisories@github.com","url":"https://github.com/GradleUp/shadow/security/advisories/GHSA-rr8v-fxxf-c986"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/GradleUp/shadow/security/advisories/GHSA-rr8v-fxxf-c986"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-75785.json b/data/2026/CVE-2026-75785.json index 9b891ccf6e..942e6a1075 100644 --- a/data/2026/CVE-2026-75785.json +++ b/data/2026/CVE-2026-75785.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-75785","lastModified":"2026-11-12T04:17:20.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.213","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-75785","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.213","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-75864.json b/data/2026/CVE-2026-75864.json index c6acd951fa..ed082eaef0 100644 --- a/data/2026/CVE-2026-75864.json +++ b/data/2026/CVE-2026-75864.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope."}],"id":"CVE-2026-75864","lastModified":"2026-11-12T13:17:16.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T13:17:16.497","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75864.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope."}],"id":"CVE-2026-75864","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T13:17:16.497","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75864.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-75867.json b/data/2026/CVE-2026-75867.json index 07df62de00..51571e752e 100644 --- a/data/2026/CVE-2026-75867.json +++ b/data/2026/CVE-2026-75867.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters."}],"id":"CVE-2026-75867","lastModified":"2026-11-12T13:17:16.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T13:17:16.633","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75867.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters."}],"id":"CVE-2026-75867","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T13:17:16.633","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75867.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-75868.json b/data/2026/CVE-2026-75868.json index 2f2f0a228c..c72c8d059d 100644 --- a/data/2026/CVE-2026-75868.json +++ b/data/2026/CVE-2026-75868.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters."}],"id":"CVE-2026-75868","lastModified":"2026-11-12T13:17:16.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T13:17:16.763","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75868.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters."}],"id":"CVE-2026-75868","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T13:17:16.763","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75868.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-75869.json b/data/2026/CVE-2026-75869.json index 43c3962363..1ebbf80d54 100644 --- a/data/2026/CVE-2026-75869.json +++ b/data/2026/CVE-2026-75869.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values."}],"id":"CVE-2026-75869","lastModified":"2026-11-12T13:17:16.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T13:17:16.900","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75869.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values."}],"id":"CVE-2026-75869","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T13:17:16.900","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75869.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76077.json b/data/2026/CVE-2026-76077.json index 4197810dc2..1f2157981d 100644 --- a/data/2026/CVE-2026-76077.json +++ b/data/2026/CVE-2026-76077.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"asn1scc","vendor":"esa","versions":[{"status":"affected","version":"< 4.7.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1."}],"id":"CVE-2026-76077","lastModified":"2026-11-09T17:17:32.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:12:28.472137Z","version":"2.0.3"}}]},"published":"2026-11-05T17:18:20.830","references":[{"source":"security-advisories@github.com","url":"https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"},{"source":"security-advisories@github.com","url":"https://github.com/esa/asn1scc/releases/tag/4.7.0.1"},{"source":"security-advisories@github.com","url":"https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"},{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"asn1scc","vendor":"esa","versions":[{"status":"affected","version":"< 4.7.0.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1."}],"id":"CVE-2026-76077","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:12:28.472137Z","version":"2.0.3"}}]},"published":"2026-11-05T17:18:20.830","references":[{"source":"security-advisories@github.com","url":"https://github.com/esa/asn1scc/commit/fe6ab763bc60d8a2def4104c15414809b45fffd9"},{"source":"security-advisories@github.com","url":"https://github.com/esa/asn1scc/releases/tag/4.7.0.1"},{"source":"security-advisories@github.com","url":"https://github.com/esa/asn1scc/security/advisories/GHSA-38q3-fg5h-wwf9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"},{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76079.json b/data/2026/CVE-2026-76079.json index d69e3d0fe8..563f8559f7 100644 --- a/data/2026/CVE-2026-76079.json +++ b/data/2026/CVE-2026-76079.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"probo","vendor":"getprobo","versions":[{"status":"affected","version":"< 0.224.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in version 0.224.0."}],"id":"CVE-2026-76079","lastModified":"2026-11-11T19:17:44.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T19:17:44.727","references":[{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/pull/1475"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/security/advisories/GHSA-cppp-g98f-gfpp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"probo","vendor":"getprobo","versions":[{"status":"affected","version":"< 0.224.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization gate. This issue has been patched in version 0.224.0."}],"id":"CVE-2026-76079","lastModified":"2026-11-12T20:18:51.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76079","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:38:33.650516Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:44.727","references":[{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/pull/1475"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/security/advisories/GHSA-cppp-g98f-gfpp"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/getprobo/probo/security/advisories/GHSA-cppp-g98f-gfpp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76173.json b/data/2026/CVE-2026-76173.json index ed68a433ac..4ab8b23577 100644 --- a/data/2026/CVE-2026-76173.json +++ b/data/2026/CVE-2026-76173.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WhatsApp for Dolibarr","vendor":"Sgestion / EasySoft","versions":[{"status":"affected","version":"1.9"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the `data.key.remoteJid` parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption."}],"id":"CVE-2026-76173","lastModified":"2026-11-12T10:17:29.353","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}]},"published":"2026-11-12T10:17:29.353","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"cve-coordination@incibe.es","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WhatsApp for Dolibarr","vendor":"Sgestion / EasySoft","versions":[{"status":"affected","version":"1.9"}]}],"source":"cve-coordination@incibe.es"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the `data.key.remoteJid` parameter, received via a JSON request, is incorporated into an SQL query without escaping or parameterization. With the WHATSAPP_WEBHOOK_ALLOW option enabled, an unauthenticated remote attacker could manipulate this parameter to alter the query. Exploitation using a timing-based technique could allow an attacker to extract information from the database and cause service disruption."}],"id":"CVE-2026-76173","lastModified":"2026-11-12T19:11:21.503","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}]},"published":"2026-11-12T10:17:29.353","references":[{"source":"cve-coordination@incibe.es","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-whatsapp-dolibarr-sgestion-easysoft"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"cve-coordination@incibe.es","type":"Primary"}]} diff --git a/data/2026/CVE-2026-76181.json b/data/2026/CVE-2026-76181.json index 75089864a2..0bae487a08 100644 --- a/data/2026/CVE-2026-76181.json +++ b/data/2026/CVE-2026-76181.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"LibreOffice","vendor":"The Document Foundation","versions":[{"lessThan":"< 26.2.6","status":"affected","version":"26.2","versionType":"26.2 series"},{"lessThan":"< 26.8.1","status":"affected","version":"26.8","versionType":"26.8 series"}]}],"source":"security@documentfoundation.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed."}],"id":"CVE-2026-76181","lastModified":"2026-11-05T21:18:53.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@documentfoundation.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76181","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:19:33.387362Z","version":"2.0.3"}}]},"published":"2026-11-05T20:17:59.693","references":[{"source":"security@documentfoundation.org","url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-76181"}],"sourceIdentifier":"security@documentfoundation.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-787"}],"source":"security@documentfoundation.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"LibreOffice","vendor":"The Document Foundation","versions":[{"lessThan":"< 26.2.6","status":"affected","version":"26.2","versionType":"26.2 series"},{"lessThan":"< 26.8.1","status":"affected","version":"26.8","versionType":"26.8 series"}]}],"source":"security@documentfoundation.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed."}],"id":"CVE-2026-76181","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@documentfoundation.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76181","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:19:33.387362Z","version":"2.0.3"}}]},"published":"2026-11-05T20:17:59.693","references":[{"source":"security@documentfoundation.org","url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-76181"}],"sourceIdentifier":"security@documentfoundation.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-787"}],"source":"security@documentfoundation.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76185.json b/data/2026/CVE-2026-76185.json index 1e68aa682e..2aee3814b4 100644 --- a/data/2026/CVE-2026-76185.json +++ b/data/2026/CVE-2026-76185.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-task-sdk","packageURL":"pkg:pypi/apache-airflow-task-sdk","product":"Apache Airflow Task SDK","vendor":"Apache Software Foundation","versions":[{"lessThan":"1.4.0","status":"affected","version":"1.2.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`."}],"id":"CVE-2026-76185","lastModified":"2026-11-12T15:17:53.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:02:13.526966Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:11.297","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/72201"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/6rqgrbqyvry6gn7g3rtrfk35gbrq6d50"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/6"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-668"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-task-sdk","packageURL":"pkg:pypi/apache-airflow-task-sdk","product":"Apache Airflow Task SDK","vendor":"Apache Software Foundation","versions":[{"lessThan":"1.4.0","status":"affected","version":"1.2.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, secret id) pairs could collide. In multi-team deployments a Dag author could read another team's Variable or Connection value by crafting a colliding secret id. Only deployments with both `core.multi_team = True` and `secrets.use_cache = True` are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later. Deployments that cannot upgrade can set `secrets.use_cache = False`."}],"id":"CVE-2026-76185","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:02:13.526966Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:11.297","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/72201"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/6rqgrbqyvry6gn7g3rtrfk35gbrq6d50"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/6"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-668"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76792.json b/data/2026/CVE-2026-76792.json index b80dbf0519..4343557d4f 100644 --- a/data/2026/CVE-2026-76792.json +++ b/data/2026/CVE-2026-76792.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"User Verification by PickPlugins","vendor":"Unknown","versions":[{"lessThan":"2.0.49","status":"affected","version":"2.0.38","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only."}],"id":"CVE-2026-76792","lastModified":"2026-11-12T12:18:24.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76792","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:15:47.190627Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:14.937","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e77de84b-3567-4ec6-a2dc-dce93c1fdc6f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"User Verification by PickPlugins","vendor":"Unknown","versions":[{"lessThan":"2.0.49","status":"affected","version":"2.0.38","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, including administrators, where the code is configured to use digits only."}],"id":"CVE-2026-76792","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76792","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T11:15:47.190627Z","version":"2.0.3"}}]},"published":"2026-11-12T06:17:14.937","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/e77de84b-3567-4ec6-a2dc-dce93c1fdc6f/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76806.json b/data/2026/CVE-2026-76806.json index 86dc1f2a7d..7aa6ea300b 100644 --- a/data/2026/CVE-2026-76806.json +++ b/data/2026/CVE-2026-76806.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"solidtime","vendor":"solidtime-io","versions":[{"status":"affected","version":"< 0.16.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0."}],"id":"CVE-2026-76806","lastModified":"2026-11-09T17:17:32.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:09:13.747209Z","version":"2.0.3"}}]},"published":"2026-11-04T20:19:12.810","references":[{"source":"security-advisories@github.com","url":"https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be"},{"source":"security-advisories@github.com","url":"https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0"},{"source":"security-advisories@github.com","url":"https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"solidtime","vendor":"solidtime-io","versions":[{"status":"affected","version":"< 0.16.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\\TemporaryDirectory\\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0."}],"id":"CVE-2026-76806","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:09:13.747209Z","version":"2.0.3"}}]},"published":"2026-11-04T20:19:12.810","references":[{"source":"security-advisories@github.com","url":"https://github.com/solidtime-io/solidtime/commit/53ecc585092e0d8fea651c1342b7acce64c601be"},{"source":"security-advisories@github.com","url":"https://github.com/solidtime-io/solidtime/releases/tag/v0.16.0"},{"source":"security-advisories@github.com","url":"https://github.com/solidtime-io/solidtime/security/advisories/GHSA-cj49-589g-wp6j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76894.json b/data/2026/CVE-2026-76894.json index 2d0e024418..39186fb4eb 100644 --- a/data/2026/CVE-2026-76894.json +++ b/data/2026/CVE-2026-76894.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ckan-mcp-server","vendor":"ondata","versions":[{"status":"affected","version":"< 0.4.112"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that can reach the embedded document can inject fabricated fields or records, spoof pending ui/initialize responses, disrupt the MCP UI handshake, or receive outbound messages when the resource is embedded by an untrusted parent. Values are HTML escaped, so the demonstrated content injection is display spoofing rather than script execution, and exploitability depends on the host embedding model. This issue is fixed in version 0.4.112."}],"id":"CVE-2026-76894","lastModified":"2026-11-09T16:17:34.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76894","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:48:13.671513Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:43.240","references":[{"source":"security-advisories@github.com","url":"https://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5"},{"source":"security-advisories@github.com","url":"https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112"},{"source":"security-advisories@github.com","url":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-940"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ckan-mcp-server","vendor":"ondata","versions":[{"status":"affected","version":"< 0.4.112"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that can reach the embedded document can inject fabricated fields or records, spoof pending ui/initialize responses, disrupt the MCP UI handshake, or receive outbound messages when the resource is embedded by an untrusted parent. Values are HTML escaped, so the demonstrated content injection is display spoofing rather than script execution, and exploitability depends on the host embedding model. This issue is fixed in version 0.4.112."}],"id":"CVE-2026-76894","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76894","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:48:13.671513Z","version":"2.0.3"}}]},"published":"2026-11-03T21:17:43.240","references":[{"source":"security-advisories@github.com","url":"https://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5"},{"source":"security-advisories@github.com","url":"https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112"},{"source":"security-advisories@github.com","url":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-940"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76954.json b/data/2026/CVE-2026-76954.json index 2c9ec4b641..f2cf77256f 100644 --- a/data/2026/CVE-2026-76954.json +++ b/data/2026/CVE-2026-76954.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.2.2-72806-10","status":"affected","version":"7.2.2","versionType":"semver"},{"lessThan":"7.2.1-69057-13","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThan":"7.2.1","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-76954","lastModified":"2026-11-12T04:17:20.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.407","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_19"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.2.2-72806-10","status":"affected","version":"7.2.2","versionType":"semver"},{"lessThan":"7.2.1-69057-13","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThan":"7.2.1","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-76954","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.407","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_19"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-76970.json b/data/2026/CVE-2026-76970.json index 892a05efa5..b41d250891 100644 --- a/data/2026/CVE-2026-76970.json +++ b/data/2026/CVE-2026-76970.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP NetWeaver and ABAP Platform","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.22EX2"},{"status":"affected","version":"7.22EX3"},{"status":"affected","version":"7.53"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"8.04"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"},{"status":"affected","version":"KERNEL 7.22"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected."}],"id":"CVE-2026-76970","lastModified":"2026-11-10T22:11:23.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Primary"}]},"published":"2026-11-10T01:17:20.687","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3792915"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"cna@sap.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP NetWeaver and ABAP Platform","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.22EX2"},{"status":"affected","version":"7.22EX3"},{"status":"affected","version":"7.53"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"8.04"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"},{"status":"affected","version":"KERNEL 7.22"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected."}],"id":"CVE-2026-76970","lastModified":"2026-11-12T17:17:45.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76970","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:07:44.672927Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:20.687","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3792915"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"cna@sap.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76973.json b/data/2026/CVE-2026-76973.json index 802be60d3d..90783aecd1 100644 --- a/data/2026/CVE-2026-76973.json +++ b/data/2026/CVE-2026-76973.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"8.04"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected."}],"id":"CVE-2026-76973","lastModified":"2026-11-10T22:11:23.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Primary"}]},"published":"2026-11-10T01:17:20.847","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3789273"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"cna@sap.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"8.04"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected."}],"id":"CVE-2026-76973","lastModified":"2026-11-12T17:17:46.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76973","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:09:29.422659Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:20.847","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3789273"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"cna@sap.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-76981.json b/data/2026/CVE-2026-76981.json index f07b4495f0..0b13fb9210 100644 --- a/data/2026/CVE-2026-76981.json +++ b/data/2026/CVE-2026-76981.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ADAudit Plus","vendor":"Zohocorp","versions":[{"lessThan":"8711","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module."}],"id":"CVE-2026-76981","lastModified":"2026-11-11T08:17:18.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-11T08:17:18.760","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/log-management/advisory/CVE-2026-92905.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ADAudit Plus","vendor":"Zohocorp","versions":[{"lessThan":"8711","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module."}],"id":"CVE-2026-76981","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-11T08:17:18.760","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/log-management/advisory/CVE-2026-92905.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-77168.json b/data/2026/CVE-2026-77168.json index 7a399e088a..439389294a 100644 --- a/data/2026/CVE-2026-77168.json +++ b/data/2026/CVE-2026-77168.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker's name, description or advertiser assignment using an authenticated victim's permissions. A leftover state-changing handler accepts request parameters without verifying a CSRF token, although it is not used by the normal invocation-tag interface. Exploitation requires victim interaction and a request path that carries the victim's session credentials. The issue is fixed in Revive Adserver 6.0.9 by removing the unused tracker-modification handler."}],"id":"CVE-2026-77168","lastModified":"2026-11-11T18:19:49.673","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:19:49.673","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3981932"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker's name, description or advertiser assignment using an authenticated victim's permissions. A leftover state-changing handler accepts request parameters without verifying a CSRF token, although it is not used by the normal invocation-tag interface. Exploitation requires victim interaction and a request path that carries the victim's session credentials. The issue is fixed in Revive Adserver 6.0.9 by removing the unused tracker-modification handler."}],"id":"CVE-2026-77168","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:19:49.673","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3981932"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-77738.json b/data/2026/CVE-2026-77738.json index 47139013cf..4712dcde03 100644 --- a/data/2026/CVE-2026-77738.json +++ b/data/2026/CVE-2026-77738.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files."}],"id":"CVE-2026-77738","lastModified":"2026-11-12T04:17:20.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.570","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files."}],"id":"CVE-2026-77738","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.570","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-81557.json b/data/2026/CVE-2026-81557.json index d26942c04d..941da85cfa 100644 --- a/data/2026/CVE-2026-81557.json +++ b/data/2026/CVE-2026-81557.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files."}],"id":"CVE-2026-81557","lastModified":"2026-11-12T04:17:20.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.740","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files."}],"id":"CVE-2026-81557","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.740","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-81558.json b/data/2026/CVE-2026-81558.json index a4c99ca495..10fa25920b 100644 --- a/data/2026/CVE-2026-81558.json +++ b/data/2026/CVE-2026-81558.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files."}],"id":"CVE-2026-81558","lastModified":"2026-11-12T04:17:20.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.890","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files."}],"id":"CVE-2026-81558","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:20.890","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-81559.json b/data/2026/CVE-2026-81559.json index 8f5d457a85..a125c607f4 100644 --- a/data/2026/CVE-2026-81559.json +++ b/data/2026/CVE-2026-81559.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files."}],"id":"CVE-2026-81559","lastModified":"2026-11-12T04:17:21.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.030","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files."}],"id":"CVE-2026-81559","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.030","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-81584.json b/data/2026/CVE-2026-81584.json index 3ce4398228..1f5958db3e 100644 --- a/data/2026/CVE-2026-81584.json +++ b/data/2026/CVE-2026-81584.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-81584","lastModified":"2026-11-12T04:17:21.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.157","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-81584","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.157","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-81843.json b/data/2026/CVE-2026-81843.json new file mode 100644 index 0000000000..35a7b46778 --- /dev/null +++ b/data/2026/CVE-2026-81843.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"11.6.16","status":"affected","version":"11.6.0","versionType":"semver"},{"lessThanOrEqual":"12.2.10","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"12.4.15","status":"affected","version":"12.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Elasticsearch Datasource","vendor":"Grafana","versions":[{"lessThan":"12.9.6","status":"affected","version":"12.4.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"11.6.16","status":"affected","version":"11.6.0","versionType":"semver"},{"lessThanOrEqual":"12.2.10","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"12.4.15","status":"affected","version":"12.3.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability.\n\nWhen an Elasticsearch data source is configured with a time-based index pattern, Grafana\ngenerated one index name for every interval in the requested query time range without any upper\nlimit. A user with permission to query the data source, which includes users holding only the\nViewer role in a default configuration, could submit a single small query with an extreme time\nrange and cause the server to allocate memory until it was terminated. The allocation occurred\nbefore any request was sent to Elasticsearch, so the condition applied whether or not the\nElasticsearch cluster was reachable.\n\nData sources configured with a static index name are not affected."}],"id":"CVE-2026-81843","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-12T18:17:53.470","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-81843"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-82014.json b/data/2026/CVE-2026-82014.json index 0bb885f3f7..99b0876c18 100644 --- a/data/2026/CVE-2026-82014.json +++ b/data/2026/CVE-2026-82014.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"11.5.10","status":"affected","version":"5.4.0","versionType":"semver"},{"lessThanOrEqual":"11.6.16","status":"affected","version":"11.6.0","versionType":"semver"},{"lessThanOrEqual":"12.0.10","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"12.1.10","status":"affected","version":"12.1.0","versionType":"semver"},{"lessThanOrEqual":"12.2.11","status":"affected","version":"12.2.0","versionType":"semver"},{"lessThanOrEqual":"12.3.11","status":"affected","version":"12.3.0","versionType":"semver"},{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"11.5.10","status":"affected","version":"5.4.0","versionType":"semver"},{"lessThanOrEqual":"11.6.16","status":"affected","version":"11.6.0","versionType":"semver"},{"lessThanOrEqual":"12.0.10","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"12.1.10","status":"affected","version":"12.1.0","versionType":"semver"},{"lessThanOrEqual":"12.2.11","status":"affected","version":"12.2.0","versionType":"semver"},{"lessThanOrEqual":"12.3.11","status":"affected","version":"12.3.0","versionType":"semver"},{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization)."}],"id":"CVE-2026-82014","lastModified":"2026-11-11T15:17:25.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:25.020","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-82014"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"security@grafana.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Grafana Enterprise","vendor":"Grafana","versions":[{"lessThanOrEqual":"11.5.10","status":"affected","version":"5.4.0","versionType":"semver"},{"lessThanOrEqual":"11.6.16","status":"affected","version":"11.6.0","versionType":"semver"},{"lessThanOrEqual":"12.0.10","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"12.1.10","status":"affected","version":"12.1.0","versionType":"semver"},{"lessThanOrEqual":"12.2.11","status":"affected","version":"12.2.0","versionType":"semver"},{"lessThanOrEqual":"12.3.11","status":"affected","version":"12.3.0","versionType":"semver"},{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Grafana OSS","vendor":"Grafana","versions":[{"lessThanOrEqual":"11.5.10","status":"affected","version":"5.4.0","versionType":"semver"},{"lessThanOrEqual":"11.6.16","status":"affected","version":"11.6.0","versionType":"semver"},{"lessThanOrEqual":"12.0.10","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"12.1.10","status":"affected","version":"12.1.0","versionType":"semver"},{"lessThanOrEqual":"12.2.11","status":"affected","version":"12.2.0","versionType":"semver"},{"lessThanOrEqual":"12.3.11","status":"affected","version":"12.3.0","versionType":"semver"},{"lessThanOrEqual":"12.4.14","status":"affected","version":"12.4.0","versionType":"semver"},{"lessThanOrEqual":"13.0.12","status":"affected","version":"13.0.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization)."}],"id":"CVE-2026-82014","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@grafana.com","type":"Secondary"}]},"published":"2026-11-11T15:17:25.020","references":[{"source":"security@grafana.com","url":"https://grafana.com/security/security-advisories/cve-2026-82014"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"security@grafana.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-82032.json b/data/2026/CVE-2026-82032.json new file mode 100644 index 0000000000..6e2d76ee68 --- /dev/null +++ b/data/2026/CVE-2026-82032.json @@ -0,0 +1 @@ +{"cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"id":"CVE-2026-82032","lastModified":"2026-11-12T17:17:46.163","metrics":{},"published":"2026-11-12T17:17:46.163","references":[],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Rejected"} diff --git a/data/2026/CVE-2026-82337.json b/data/2026/CVE-2026-82337.json index e4a724d39f..4db95399fd 100644 --- a/data/2026/CVE-2026-82337.json +++ b/data/2026/CVE-2026-82337.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use deadline alerts are affected.\n\nThis is an incomplete fix of CVE-2026-45360, which only hardened the `reference` field; deployments that applied that fix remain affected through the `callback` and `interval` fields.\n\nUsers of apache-airflow are recommended to upgrade to 3.4.0 or later."}],"id":"CVE-2026-82337","lastModified":"2026-11-10T21:12:56.660","metrics":{},"published":"2026-11-09T10:17:11.467","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/72651"},{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/74830"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/9v8f3hlm6pxbwl2jt1c2bw84s80gg6kp"},{"source":"security@apache.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-45360"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use deadline alerts are affected.\n\nThis is an incomplete fix of CVE-2026-45360, which only hardened the `reference` field; deployments that applied that fix remain affected through the `callback` and `interval` fields.\n\nUsers of apache-airflow are recommended to upgrade to 3.4.0 or later."}],"id":"CVE-2026-82337","lastModified":"2026-11-12T20:18:51.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82337","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:51:47.868990Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:11.467","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/72651"},{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/74830"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/9v8f3hlm6pxbwl2jt1c2bw84s80gg6kp"},{"source":"security@apache.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-45360"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-82436.json b/data/2026/CVE-2026-82436.json index 8e5c00d283..a2ab27398c 100644 --- a/data/2026/CVE-2026-82436.json +++ b/data/2026/CVE-2026-82436.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-client","packageURL":"pkg:maven/org.apache.storm/storm-client","product":"Apache Storm Client","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.1.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Description\n\n`DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class\nregistration disabled and an instantiation strategy that constructs objects without invoking their\nconstructors, then deserialized whatever bytes the state store returned. A party able to write to the\ntopology's keyspace in the state store, for example a co-tenant of a shared Redis instance or anyone with\nnetwork access to it, could therefore place a serialized object graph that executes code inside the worker\nJVM when the state is restored.\n\nThis requires the Redis-backed state provider, which is not the default. Write access to a state-store key\nis a data-plane privilege; code execution in the worker JVM is not, so the two are not equivalent.\n\nMitigation\n\nUpgrade to 3.1.0, where the state serializer requires registered classes.\n\nNote that this is a behaviour change for existing state: checkpoints written by an affected version may fail\nto restore, and a migration step may be required. Users who cannot upgrade immediately should restrict\nnetwork and credential access to the state store to the cluster itself.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."}],"id":"CVE-2026-82436","lastModified":"2026-11-12T16:19:14.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82436","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:20:10.000719Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:11.633","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/q5vqclkjdvngwkffcbwbwyym410sp8sc"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/1"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-client","packageURL":"pkg:maven/org.apache.storm/storm-client","product":"Apache Storm Client","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.1.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Description\n\n`DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class\nregistration disabled and an instantiation strategy that constructs objects without invoking their\nconstructors, then deserialized whatever bytes the state store returned. A party able to write to the\ntopology's keyspace in the state store, for example a co-tenant of a shared Redis instance or anyone with\nnetwork access to it, could therefore place a serialized object graph that executes code inside the worker\nJVM when the state is restored.\n\nThis requires the Redis-backed state provider, which is not the default. Write access to a state-store key\nis a data-plane privilege; code execution in the worker JVM is not, so the two are not equivalent.\n\nMitigation\n\nUpgrade to 3.1.0, where the state serializer requires registered classes.\n\nNote that this is a behaviour change for existing state: checkpoints written by an affected version may fail\nto restore, and a migration step may be required. Users who cannot upgrade immediately should restrict\nnetwork and credential access to the state store to the cluster itself.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."}],"id":"CVE-2026-82436","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82436","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:20:10.000719Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:11.633","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/q5vqclkjdvngwkffcbwbwyym410sp8sc"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/1"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-82440.json b/data/2026/CVE-2026-82440.json index a35caef5b2..ed59da2bf0 100644 --- a/data/2026/CVE-2026-82440.json +++ b/data/2026/CVE-2026-82440.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-client","packageURL":"pkg:maven/org.apache.storm/storm-client","product":"Apache Storm Nimbus","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.1.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Description\n\nNimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it. The\nallowlist intended to constrain that choice, `nimbus.scheduler.strategy.class.whitelist`, was treated as\n\"allow any class\" when unset, and it had no entry in the shipped `defaults.yaml`, so unset was the shipped\nstate. An authenticated submitter could therefore cause Nimbus to instantiate any class on the Nimbus\nclasspath that has a no-argument constructor.\n\nStorm's own production artifacts contain classes with side effects suitable for this: instantiating\n`org.apache.storm.testing.InProcessZookeeper` starts a ZooKeeper server with its own threads and sockets\nand nothing closes it, and `org.apache.storm.LocalCluster` behaves similarly. Repeated submissions\ntherefore consume threads, sockets and memory in the most privileged daemon in the cluster.\n\nMitigation\n\nUpgrade to 3.1.0, where an unset allowlist means the strategies shipped with Storm rather than any class.\n\nNote that this is a behaviour change: a cluster running an out-of-tree scheduler strategy without an\nexplicit allowlist will have those topologies refused until the class is added to\n`nimbus.scheduler.strategy.class.whitelist`. The rejection message names the refused class and the\nconfiguration key.\n\nUsers who cannot upgrade immediately should set `nimbus.scheduler.strategy.class.whitelist` explicitly to\nthe strategies they intend to permit."}],"id":"CVE-2026-82440","lastModified":"2026-11-12T16:19:14.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82440","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:18:36.175626Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:11.797","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/hxcyk1vg9qx8bzos8g3kx91nz8d23jgt"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/2"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-470"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-client","packageURL":"pkg:maven/org.apache.storm/storm-client","product":"Apache Storm Nimbus","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.1.0","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Description\n\nNimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it. The\nallowlist intended to constrain that choice, `nimbus.scheduler.strategy.class.whitelist`, was treated as\n\"allow any class\" when unset, and it had no entry in the shipped `defaults.yaml`, so unset was the shipped\nstate. An authenticated submitter could therefore cause Nimbus to instantiate any class on the Nimbus\nclasspath that has a no-argument constructor.\n\nStorm's own production artifacts contain classes with side effects suitable for this: instantiating\n`org.apache.storm.testing.InProcessZookeeper` starts a ZooKeeper server with its own threads and sockets\nand nothing closes it, and `org.apache.storm.LocalCluster` behaves similarly. Repeated submissions\ntherefore consume threads, sockets and memory in the most privileged daemon in the cluster.\n\nMitigation\n\nUpgrade to 3.1.0, where an unset allowlist means the strategies shipped with Storm rather than any class.\n\nNote that this is a behaviour change: a cluster running an out-of-tree scheduler strategy without an\nexplicit allowlist will have those topologies refused until the class is added to\n`nimbus.scheduler.strategy.class.whitelist`. The rejection message names the refused class and the\nconfiguration key.\n\nUsers who cannot upgrade immediately should set `nimbus.scheduler.strategy.class.whitelist` explicitly to\nthe strategies they intend to permit."}],"id":"CVE-2026-82440","lastModified":"2026-11-12T17:05:26.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82440","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:18:36.175626Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:11.797","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/hxcyk1vg9qx8bzos8g3kx91nz8d23jgt"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/2"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-470"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-82518.json b/data/2026/CVE-2026-82518.json index 8c07aab55d..a30664572e 100644 --- a/data/2026/CVE-2026-82518.json +++ b/data/2026/CVE-2026-82518.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/akamai/cli/v2","product":"Akamai CLI","repo":"https://github.com/akamai/cli","vendor":"Akamai","versions":[{"lessThan":"2.0.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akamai CLI before 2.0.6 contains a path traversal vulnerability that allows malicious packages to write files outside the install directory via unvalidated commands[].name values in cli.json. Attackers who convince victims to install or update a package can use '..' segments to overwrite executables on the user's PATH, persisting after uninstall."}],"id":"CVE-2026-82518","lastModified":"2026-11-10T17:17:48.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T17:17:48.770","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/thesmartshadow/39f1c49ff74099b675e2576171390003"},{"source":"disclosure@vulncheck.com","url":"https://github.com/akamai/cli/blob/cae602db7ed79a173763da03a31614e8b60275ca/pkg/commands/subcommands.go#L155"},{"source":"disclosure@vulncheck.com","url":"https://github.com/akamai/cli/blob/cae602db7ed79a173763da03a31614e8b60275ca/pkg/packages/golang.go#L75-L78"},{"source":"disclosure@vulncheck.com","url":"https://github.com/akamai/cli/commit/03cf2e4d7db3680ee8230aa399697d74b0ec5244"},{"source":"disclosure@vulncheck.com","url":"https://github.com/akamai/cli/pull/227"},{"source":"disclosure@vulncheck.com","url":"https://github.com/akamai/cli/releases/tag/v2.0.6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/akamai-cli-before-2.0.6-path-traversal-via-cli-json-command-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/akamai/cli/v2","product":"Akamai CLI","repo":"https://github.com/akamai/cli","vendor":"Akamai","versions":[{"lessThan":"2.0.6","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akamai CLI before 2.0.6 contains a path traversal vulnerability that allows malicious packages to write files outside the install directory via unvalidated commands[].name values in cli.json. Attackers who convince victims to install or update a package can use '..' segments to overwrite executables on the user's PATH, persisting after uninstall."}],"id":"CVE-2026-82518","lastModified":"2026-11-12T19:17:06.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82518","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:57:26.901865Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:48.770","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/thesmartshadow/39f1c49ff74099b675e2576171390003"},{"source":"disclosure@vulncheck.com","url":"https://github.com/akamai/cli/blob/cae602db7ed79a173763da03a31614e8b60275ca/pkg/commands/subcommands.go#L155"},{"source":"disclosure@vulncheck.com","url":"https://github.com/akamai/cli/blob/cae602db7ed79a173763da03a31614e8b60275ca/pkg/packages/golang.go#L75-L78"},{"source":"disclosure@vulncheck.com","url":"https://github.com/akamai/cli/commit/03cf2e4d7db3680ee8230aa399697d74b0ec5244"},{"source":"disclosure@vulncheck.com","url":"https://github.com/akamai/cli/pull/227"},{"source":"disclosure@vulncheck.com","url":"https://github.com/akamai/cli/releases/tag/v2.0.6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/akamai-cli-before-2.0.6-path-traversal-via-cli-json-command-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-82977.json b/data/2026/CVE-2026-82977.json new file mode 100644 index 0000000000..63f310ec5f --- /dev/null +++ b/data/2026/CVE-2026-82977.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Plesk","vendor":"WebPros","versions":[{"lessThanOrEqual":"18.0.81.7","status":"affected","version":"18.0.77","versionType":"semver"},{"lessThanOrEqual":"18.0.82.2","status":"affected","version":"18.0.82","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure."}],"id":"CVE-2026-82977","lastModified":"2026-11-12T17:17:46.230","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-12T17:17:46.230","references":[{"source":"support@hackerone.com","url":"https://support.plesk.com/hc/en-us/articles/44915912496535-Vulnerability-CVE-2026-82977-Information-disclosure-in-Plesk-for-Linux-web-statistics"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-82978.json b/data/2026/CVE-2026-82978.json index 40adadc9e9..21338af087 100644 --- a/data/2026/CVE-2026-82978.json +++ b/data/2026/CVE-2026-82978.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule set belonging to another agency by changing the submitted agencyid parameter. The server trusts the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than submitted form data and removing the agency identifier from the form's hidden fields."}],"id":"CVE-2026-82978","lastModified":"2026-11-11T18:19:49.960","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:19:49.960","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3929216"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule set belonging to another agency by changing the submitted agencyid parameter. The server trusts the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than submitted form data and removing the agency identifier from the form's hidden fields."}],"id":"CVE-2026-82978","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"support@hackerone.com","type":"Secondary"}]},"published":"2026-11-11T18:19:49.960","references":[{"source":"support@hackerone.com","url":"https://hackerone.com/reports/3929216"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-83528.json b/data/2026/CVE-2026-83528.json index 1f926c1556..f4d8ff484b 100644 --- a/data/2026/CVE-2026-83528.json +++ b/data/2026/CVE-2026-83528.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information."}],"id":"CVE-2026-83528","lastModified":"2026-11-10T18:17:48.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T17:17:49.130","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-359"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.11.0.0","versionType":"custom"},{"status":"unaffected","version":"12.10.0.1","versionType":"custom"},{"status":"unaffected","version":"12.9.0.3","versionType":"custom"}]}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information."}],"id":"CVE-2026-83528","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]},"published":"2026-11-10T17:17:49.130","references":[{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","url":"https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs"}],"sourceIdentifier":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-359"}],"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-8372.json b/data/2026/CVE-2026-8372.json index d673dc16a1..ac96c55f40 100644 --- a/data/2026/CVE-2026-8372.json +++ b/data/2026/CVE-2026-8372.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.13","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability that could allow an attacker to gain unauthorized access."}],"id":"CVE-2026-8372","lastModified":"2026-11-10T06:17:10.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:10.420","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/09/58/fa/cve-2026-8372pdf-en-US-561247.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS Camera Station Pro","vendor":"Axis Communications AB","versions":[{"lessThan":"6.18","status":"affected","version":"6.13","versionType":"maven"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability that could allow an attacker to gain unauthorized access."}],"id":"CVE-2026-8372","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-8372","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:40:05.675434Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:10.420","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/09/58/fa/cve-2026-8372pdf-en-US-561247.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-84155.json b/data/2026/CVE-2026-84155.json index cc7ee16105..016dbb0557 100644 --- a/data/2026/CVE-2026-84155.json +++ b/data/2026/CVE-2026-84155.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"CodeChecker","vendor":"Ericsson","versions":[{"changes":[{"at":"6.29.3","status":"unaffected"}],"lessThan":"6.29.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own\nin-memory session cache; logout only clears the cache of the single worker that handles the request (plus the shared database record). Other workers continue to honor the destroyed token\nfrom their stale in-memory copies until the session's lifetime expires. An attacker who has captured a valid token can therefore keep impersonating the user after the user has logged out."}],"id":"CVE-2026-84155","lastModified":"2026-11-10T18:17:48.857","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84155","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:44:06.507542Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:17.043","references":[{"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-r42x-9wgw-cqc2"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-r42x-9wgw-cqc2"}],"sourceIdentifier":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"CodeChecker","vendor":"Ericsson","versions":[{"changes":[{"at":"6.29.3","status":"unaffected"}],"lessThan":"6.29.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own\nin-memory session cache; logout only clears the cache of the single worker that handles the request (plus the shared database record). Other workers continue to honor the destroyed token\nfrom their stale in-memory copies until the session's lifetime expires. An attacker who has captured a valid token can therefore keep impersonating the user after the user has logged out."}],"id":"CVE-2026-84155","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84155","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:44:06.507542Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:17.043","references":[{"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-r42x-9wgw-cqc2"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-r42x-9wgw-cqc2"}],"sourceIdentifier":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-84161.json b/data/2026/CVE-2026-84161.json index 634b27038c..43034a7b3c 100644 --- a/data/2026/CVE-2026-84161.json +++ b/data/2026/CVE-2026-84161.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"CodeChecker","vendor":"Ericsson","versions":[{"changes":[{"at":"6.29.3","status":"unaffected"}],"lessThan":"6.29.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to one-shot zlib.decompress(). No maximum decompressed size is enforced.\n\n\n\nThis gives a correctly authorized, non-superuser store account a high-ratio memory and persistent-disk amplification primitive. The complete output is first materialized as a Python bytes object and is then written to the configured statistics directory. A sufficiently scaled payload can exhaust the API worker or host memory and impair CodeChecker availability.\n\n\n\nThe shipped value of store.analysis_statistics_dir is null, so the affected feature is disabled by default. The primary assessment does not rely on authentication being disabled. There is no authorization bypass and no path traversal in this report."}],"id":"CVE-2026-84161","lastModified":"2026-11-10T15:17:29.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84161","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:59:37.444938Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:17.190","references":[{"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-w57m-6g36-jjwv"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-w57m-6g36-jjwv"}],"sourceIdentifier":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"},{"lang":"en","value":"CWE-770"}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"CodeChecker","vendor":"Ericsson","versions":[{"changes":[{"at":"6.29.3","status":"unaffected"}],"lessThan":"6.29.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to one-shot zlib.decompress(). No maximum decompressed size is enforced.\n\n\n\nThis gives a correctly authorized, non-superuser store account a high-ratio memory and persistent-disk amplification primitive. The complete output is first materialized as a Python bytes object and is then written to the configured statistics directory. A sufficiently scaled payload can exhaust the API worker or host memory and impair CodeChecker availability.\n\n\n\nThe shipped value of store.analysis_statistics_dir is null, so the affected feature is disabled by default. The primary assessment does not rely on authentication being disabled. There is no authorization bypass and no path traversal in this report."}],"id":"CVE-2026-84161","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84161","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:59:37.444938Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:17.190","references":[{"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-w57m-6g36-jjwv"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-w57m-6g36-jjwv"}],"sourceIdentifier":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"},{"lang":"en","value":"CWE-770"}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-84164.json b/data/2026/CVE-2026-84164.json index 12158136d7..709256f064 100644 --- a/data/2026/CVE-2026-84164.json +++ b/data/2026/CVE-2026-84164.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"CodeChecker","vendor":"Ericsson","versions":[{"changes":[{"at":"6.29.3","status":"unaffected"}],"lessThan":"6.29.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML.\n\n\n\n\nThe input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one."}],"id":"CVE-2026-84164","lastModified":"2026-11-10T15:17:29.807","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":0.0,"baseSeverity":"NONE","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84164","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:00:58.803007Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:17.327","references":[{"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-6w9g-677j-q2xq"}],"sourceIdentifier":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"CodeChecker","vendor":"Ericsson","versions":[{"changes":[{"at":"6.29.3","status":"unaffected"}],"lessThan":"6.29.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML.\n\n\n\n\nThe input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one."}],"id":"CVE-2026-84164","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":0.0,"baseSeverity":"NONE","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84164","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:00:58.803007Z","version":"2.0.3"}}]},"published":"2026-11-06T11:17:17.327","references":[{"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-6w9g-677j-q2xq"}],"sourceIdentifier":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-84410.json b/data/2026/CVE-2026-84410.json index ee59eae054..5b4bf1fd73 100644 --- a/data/2026/CVE-2026-84410.json +++ b/data/2026/CVE-2026-84410.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"apport","platforms":["Linux"],"product":"apport","repo":"https://github.com/canonical/apport","vendor":"Canonical","versions":[{"lessThan":"2.37.0","status":"affected","version":"2.9.0","versionType":"semver"}]}],"source":"security@ubuntu.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker to gain root privileges on systems where automatic crash reporting is enabled. The automatic crash report processing pipeline runs as root and executes ldd on the attacker-controlled ExecutablePath field of a crash file placed in the world-writable /var/crash directory, causing the dynamic loader to load and execute an attacker-supplied audit module specified by the ELF's DT_AUDIT tag. This allows an attacker to execute arbitrary code with root privileges and fully compromise the affected system."}],"id":"CVE-2026-84410","lastModified":"2026-11-09T22:18:55.417","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@ubuntu.com","type":"Secondary"}]},"published":"2026-11-09T22:18:55.417","references":[{"source":"security@ubuntu.com","url":"https://bugs.launchpad.net/ubuntu/+source/apport/+bug/2164767"},{"source":"security@ubuntu.com","url":"https://github.com/canonical/apport/commit/bc7cc6a70590d6596e1f96ad74a021f2c598d73d"},{"source":"security@ubuntu.com","url":"https://github.com/canonical/apport/pull/656"}],"sourceIdentifier":"security@ubuntu.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"security@ubuntu.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"apport","platforms":["Linux"],"product":"apport","repo":"https://github.com/canonical/apport","vendor":"Canonical","versions":[{"lessThan":"2.37.0","status":"affected","version":"2.9.0","versionType":"semver"}]}],"source":"security@ubuntu.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker to gain root privileges on systems where automatic crash reporting is enabled. The automatic crash report processing pipeline runs as root and executes ldd on the attacker-controlled ExecutablePath field of a crash file placed in the world-writable /var/crash directory, causing the dynamic loader to load and execute an attacker-supplied audit module specified by the ELF's DT_AUDIT tag. This allows an attacker to execute arbitrary code with root privileges and fully compromise the affected system."}],"id":"CVE-2026-84410","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@ubuntu.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84410","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:52:43.114889Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:55.417","references":[{"source":"security@ubuntu.com","url":"https://bugs.launchpad.net/ubuntu/+source/apport/+bug/2164767"},{"source":"security@ubuntu.com","url":"https://github.com/canonical/apport/commit/bc7cc6a70590d6596e1f96ad74a021f2c598d73d"},{"source":"security@ubuntu.com","url":"https://github.com/canonical/apport/pull/656"}],"sourceIdentifier":"security@ubuntu.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"security@ubuntu.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-84473.json b/data/2026/CVE-2026-84473.json index 54ec4e450a..a3985cad1a 100644 --- a/data/2026/CVE-2026-84473.json +++ b/data/2026/CVE-2026-84473.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ownCloud","vendor":"Kiteworks","versions":[{"lessThan":"11.1.0","status":"affected","version":"10.16.3","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint."}],"id":"CVE-2026-84473","lastModified":"2026-11-10T19:21:24.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84473","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:23:52.386153Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:57.687","references":[{"source":"cret@cert.org","url":"https://github.com/KOBUKOVUI/CVE-2026-84473"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"},{"lang":"en","value":"CWE-307"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ownCloud","vendor":"Kiteworks","versions":[{"lessThan":"11.1.0","status":"affected","version":"10.16.3","versionType":"custom"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint."}],"id":"CVE-2026-84473","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84473","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:23:52.386153Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:57.687","references":[{"source":"cret@cert.org","url":"https://github.com/KOBUKOVUI/CVE-2026-84473"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"},{"lang":"en","value":"CWE-307"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-84729.json b/data/2026/CVE-2026-84729.json index 84dea7b9d0..d67f6bd43b 100644 --- a/data/2026/CVE-2026-84729.json +++ b/data/2026/CVE-2026-84729.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"ASUSWRT 3.0.0.4_386 series","versionType":"custom"},{"status":"affected","version":"ASUSWRT 3.0.0.4_388 series","versionType":"custom"},{"status":"affected","version":"ASUSWRT 3.0.0.6_102 series","versionType":"custom"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packet.\nRefer to the ' \nSecurity Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-84729","lastModified":"2026-11-04T16:17:53.300","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84729","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T14:54:12.410584Z","version":"2.0.3"}}]},"published":"2026-11-04T02:17:21.163","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"ASUSWRT 3.0.0.4_386 series","versionType":"custom"},{"status":"affected","version":"ASUSWRT 3.0.0.4_388 series","versionType":"custom"},{"status":"affected","version":"ASUSWRT 3.0.0.6_102 series","versionType":"custom"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packet.\nRefer to the ' \nSecurity Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-84729","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84729","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T14:54:12.410584Z","version":"2.0.3"}}]},"published":"2026-11-04T02:17:21.163","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-84730.json b/data/2026/CVE-2026-84730.json index 72808b40f4..c2589ae823 100644 --- a/data/2026/CVE-2026-84730.json +++ b/data/2026/CVE-2026-84730.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"ASUSWRT 3.0.0.4_386 series","versionType":"custom"},{"status":"affected","version":"ASUSWRT 3.0.0.4_388 series"},{"status":"affected","version":"ASUSWRT 3.0.0.6_102 series"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name.\nRefer to the '\nSecurity Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-84730","lastModified":"2026-11-05T05:18:38.797","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84730","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-04T02:17:21.323","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"ASUSWRT 3.0.0.4_386 series","versionType":"custom"},{"status":"affected","version":"ASUSWRT 3.0.0.4_388 series"},{"status":"affected","version":"ASUSWRT 3.0.0.6_102 series"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name.\nRefer to the '\nSecurity Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-84730","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84730","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-04T02:17:21.323","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-85098.json b/data/2026/CVE-2026-85098.json index 3b2aa9bd94..c8fe8e6084 100644 --- a/data/2026/CVE-2026-85098.json +++ b/data/2026/CVE-2026-85098.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct limited denial-of-service attacks."}],"id":"CVE-2026-85098","lastModified":"2026-11-12T04:17:21.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.310","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct limited denial-of-service attacks."}],"id":"CVE-2026-85098","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.310","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-85101.json b/data/2026/CVE-2026-85101.json index 82a650c880..30665e0980 100644 --- a/data/2026/CVE-2026-85101.json +++ b/data/2026/CVE-2026-85101.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.2.2-72806-10","status":"affected","version":"7.2.2","versionType":"semver"},{"lessThan":"7.2.1-69057-13","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThan":"7.2.1","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks."}],"id":"CVE-2026-85101","lastModified":"2026-11-12T04:17:21.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.617","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_19"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.2.2-72806-10","status":"affected","version":"7.2.2","versionType":"semver"},{"lessThan":"7.2.1-69057-13","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThan":"7.2.1","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks."}],"id":"CVE-2026-85101","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.617","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_19"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-85286.json b/data/2026/CVE-2026-85286.json index b31bfa4399..b8ed539f4d 100644 --- a/data/2026/CVE-2026-85286.json +++ b/data/2026/CVE-2026-85286.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"homebox","vendor":"sysadminsmedia","versions":[{"status":"affected","version":"< 0.27.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0."}],"id":"CVE-2026-85286","lastModified":"2026-11-09T17:17:33.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-85286","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:10:15.229504Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:50.463","references":[{"source":"security-advisories@github.com","url":"https://github.com/sysadminsmedia/homebox/commit/66809ce3583cbd0b43e8f5ce30cc269a1cfe4201"},{"source":"security-advisories@github.com","url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0"},{"source":"security-advisories@github.com","url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-4p8r-vm9v-c9pm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-204"},{"lang":"en","value":"CWE-208"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"homebox","vendor":"sysadminsmedia","versions":[{"status":"affected","version":"< 0.27.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0."}],"id":"CVE-2026-85286","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-85286","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:10:15.229504Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:50.463","references":[{"source":"security-advisories@github.com","url":"https://github.com/sysadminsmedia/homebox/commit/66809ce3583cbd0b43e8f5ce30cc269a1cfe4201"},{"source":"security-advisories@github.com","url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0"},{"source":"security-advisories@github.com","url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-4p8r-vm9v-c9pm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-204"},{"lang":"en","value":"CWE-208"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-85632.json b/data/2026/CVE-2026-85632.json index 7e9cc45b9a..901890098c 100644 --- a/data/2026/CVE-2026-85632.json +++ b/data/2026/CVE-2026-85632.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WooCommerce Virtual POS Module","vendor":"Sipay Electronic Money and Payment Services Inc.","versions":[{"lessThan":"26.9.1","status":"affected","version":"26.8.3","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle.\n\nThis issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1."}],"id":"CVE-2026-85632","lastModified":"2026-11-11T15:17:25.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-11T15:17:25.163","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1520"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-354"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WooCommerce Virtual POS Module","vendor":"Sipay Electronic Money and Payment Services Inc.","versions":[{"lessThan":"26.9.1","status":"affected","version":"26.8.3","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle.\n\nThis issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1."}],"id":"CVE-2026-85632","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-11T15:17:25.163","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1520"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-354"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} diff --git a/data/2026/CVE-2026-86336.json b/data/2026/CVE-2026-86336.json index a25cd46f58..cdcf81292d 100644 --- a/data/2026/CVE-2026-86336.json +++ b/data/2026/CVE-2026-86336.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.3.0","status":"affected","version":"10.1.1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-86336","lastModified":"2026-11-10T16:17:24.697","metrics":{},"published":"2026-11-10T16:17:24.697","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/tv0407xmnpy4qctqm9nzx56lgjln2t4j"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.3.0","status":"affected","version":"10.1.1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-86336","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:24.697","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/tv0407xmnpy4qctqm9nzx56lgjln2t4j"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-86343.json b/data/2026/CVE-2026-86343.json index 1068d87c16..3cf9fe410d 100644 --- a/data/2026/CVE-2026-86343.json +++ b/data/2026/CVE-2026-86343.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-86343","lastModified":"2026-11-12T04:17:21.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.813","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks."}],"id":"CVE-2026-86343","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.813","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-86363.json b/data/2026/CVE-2026-86363.json index 3b349effb0..42f611c141 100644 --- a/data/2026/CVE-2026-86363.json +++ b/data/2026/CVE-2026-86363.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Optics Collector","vendor":"Dell","versions":[{"lessThan":"27.3.13.330 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Live Optics Collector, versions prior to 27.3.13.330 contains a Generation of Predictable IV with CBC Mode vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-86363","lastModified":"2026-11-11T18:19:50.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:50.837","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000529138/dsa-2026-485-security-update-for-dell-live-optics-collector-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-329"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Optics Collector","vendor":"Dell","versions":[{"lessThan":"27.3.13.330 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Live Optics Collector, versions prior to 27.3.13.330 contains a Generation of Predictable IV with CBC Mode vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-86363","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:50.837","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000529138/dsa-2026-485-security-update-for-dell-live-optics-collector-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-329"}],"source":"security_alert@emc.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-86364.json b/data/2026/CVE-2026-86364.json index 3e910a23ea..af5bcbaa54 100644 --- a/data/2026/CVE-2026-86364.json +++ b/data/2026/CVE-2026-86364.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Optics Collector","vendor":"Dell","versions":[{"lessThan":"27.3.8.317 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Live Optics Collector, versions prior to 27.3.8.317 contains a Use of Insufficiently Random Values vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-86364","lastModified":"2026-11-11T18:19:50.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:50.980","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000529141/dsa-2026-484-security-update-for-dell-live-optics-collector-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Optics Collector","vendor":"Dell","versions":[{"lessThan":"27.3.8.317 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Live Optics Collector, versions prior to 27.3.8.317 contains a Use of Insufficiently Random Values vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-86364","lastModified":"2026-11-12T20:18:52.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86364","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:36:06.766223Z","version":"2.0.3"}}]},"published":"2026-11-11T18:19:50.980","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000529141/dsa-2026-484-security-update-for-dell-live-optics-collector-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-86468.json b/data/2026/CVE-2026-86468.json index eb97d1db1c..b501258cea 100644 --- a/data/2026/CVE-2026-86468.json +++ b/data/2026/CVE-2026-86468.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow","packageURL":"pkg:pypi/apache-airflow","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--password` of `airflow keycloak-auth-manager` commands. A user who can read audit events but is denied Variable and Connection access can retrieve those values through the event-log API.\n\nUsers of apache-airflow are recommended to upgrade to 3.4.0 or later. Audit-log entries written before the upgrade keep the cleartext values: purge the affected entries and rotate the secrets they contain. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later."}],"id":"CVE-2026-86468","lastModified":"2026-11-10T21:12:54.140","metrics":{},"published":"2026-11-09T10:17:11.963","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/72650"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/yl4dlhvstlnc1qogcw3n4bx216cjsmoo"},{"source":"security@apache.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-50204"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow","packageURL":"pkg:pypi/apache-airflow","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--password` of `airflow keycloak-auth-manager` commands. A user who can read audit events but is denied Variable and Connection access can retrieve those values through the event-log API.\n\nUsers of apache-airflow are recommended to upgrade to 3.4.0 or later. Audit-log entries written before the upgrade keep the cleartext values: purge the affected entries and rotate the secrets they contain. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later."}],"id":"CVE-2026-86468","lastModified":"2026-11-12T20:18:52.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:49:48.748648Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:11.963","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/72650"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/yl4dlhvstlnc1qogcw3n4bx216cjsmoo"},{"source":"security@apache.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-50204"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-86531.json b/data/2026/CVE-2026-86531.json index 0ea78c74bc..e4dcef9d81 100644 --- a/data/2026/CVE-2026-86531.json +++ b/data/2026/CVE-2026-86531.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-http","packageURL":"pkg:maven/org.apache.openejb/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-86531","lastModified":"2026-11-10T16:17:24.817","metrics":{},"published":"2026-11-10T16:17:24.817","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/cm1vdbx03ctl607nrrkdqyshwjscpd2y"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-http","packageURL":"pkg:maven/org.apache.openejb/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-86531","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:24.817","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/cm1vdbx03ctl607nrrkdqyshwjscpd2y"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-86532.json b/data/2026/CVE-2026-86532.json index 63ff613508..4225654f65 100644 --- a/data/2026/CVE-2026-86532.json +++ b/data/2026/CVE-2026-86532.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-86532","lastModified":"2026-11-10T15:17:30.073","metrics":{},"published":"2026-11-10T15:17:30.073","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/oohwxbp6xx8dgl18xy1p1y6qjg59dgoh"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-203"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-86532","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T15:17:30.073","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/oohwxbp6xx8dgl18xy1p1y6qjg59dgoh"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-203"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-86692.json b/data/2026/CVE-2026-86692.json index e7677bd284..cc82445c87 100644 --- a/data/2026/CVE-2026-86692.json +++ b/data/2026/CVE-2026-86692.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"apport","platforms":["Linux"],"product":"apport","repo":"https://github.com/canonical/apport","vendor":"Canonical","versions":[{"lessThan":"2.37.0","status":"affected","version":"2.16.0","versionType":"semver"}]}],"source":"security@ubuntu.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack.\n\nThe key-name validation added for CVE-2026-77113 does not cover base64-encoded keys skipped by ProblemReport.load(binary=False), and ProblemReport.extract_keys() writes them to a file path built from the key without validation. This allows an attacker to create or overwrite arbitrary files writable by the invoking user, such as .bashrc or .profile, gaining persistence or code execution in that user's context."}],"id":"CVE-2026-86692","lastModified":"2026-11-09T22:18:55.723","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@ubuntu.com","type":"Secondary"}]},"published":"2026-11-09T22:18:55.723","references":[{"source":"security@ubuntu.com","url":"https://bugs.launchpad.net/ubuntu/+source/apport/+bug/2167360"},{"source":"security@ubuntu.com","url":"https://github.com/canonical/apport/commit/ca041037929ea3ebd3e0997dcedcf908ca3599a6"},{"source":"security@ubuntu.com","url":"https://github.com/canonical/apport/pull/650"}],"sourceIdentifier":"security@ubuntu.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@ubuntu.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"apport","platforms":["Linux"],"product":"apport","repo":"https://github.com/canonical/apport","vendor":"Canonical","versions":[{"lessThan":"2.37.0","status":"affected","version":"2.16.0","versionType":"semver"}]}],"source":"security@ubuntu.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack.\n\nThe key-name validation added for CVE-2026-77113 does not cover base64-encoded keys skipped by ProblemReport.load(binary=False), and ProblemReport.extract_keys() writes them to a file path built from the key without validation. This allows an attacker to create or overwrite arbitrary files writable by the invoking user, such as .bashrc or .profile, gaining persistence or code execution in that user's context."}],"id":"CVE-2026-86692","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@ubuntu.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86692","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:51:41.653730Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:55.723","references":[{"source":"security@ubuntu.com","url":"https://bugs.launchpad.net/ubuntu/+source/apport/+bug/2167360"},{"source":"security@ubuntu.com","url":"https://github.com/canonical/apport/commit/ca041037929ea3ebd3e0997dcedcf908ca3599a6"},{"source":"security@ubuntu.com","url":"https://github.com/canonical/apport/pull/650"}],"sourceIdentifier":"security@ubuntu.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@ubuntu.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-86811.json b/data/2026/CVE-2026-86811.json index 8b497ec861..b34fd9f36d 100644 --- a/data/2026/CVE-2026-86811.json +++ b/data/2026/CVE-2026-86811.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-86811","lastModified":"2026-11-10T15:17:30.193","metrics":{},"published":"2026-11-10T15:17:30.193","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/f2x7r654o1nt2z98m39kk0m6x24mz69f"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-86811","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T15:17:30.193","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/f2x7r654o1nt2z98m39kk0m6x24mz69f"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-86829.json b/data/2026/CVE-2026-86829.json index f7bd221bed..298c3f4826 100644 --- a/data/2026/CVE-2026-86829.json +++ b/data/2026/CVE-2026-86829.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for code installed by the Deployment Manager, above the worker-scoped execution capability a Dag author is documented to have. Deployments that treat Dag authors as less trusted than Deployment Managers are affected, and the scheduler must be evaluating a task dependency that reads a task-written XCom value. Users of apache-airflow are recommended to upgrade to version 3.4.0 or later, which restricts dependency evaluation to primitive XCom values."}],"id":"CVE-2026-86829","lastModified":"2026-11-10T21:12:56.703","metrics":{},"published":"2026-11-09T10:17:13.757","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/72718"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/2qbt7qnclrlxtg3f1b685533r3mvk9hv"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/9"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for code installed by the Deployment Manager, above the worker-scoped execution capability a Dag author is documented to have. Deployments that treat Dag authors as less trusted than Deployment Managers are affected, and the scheduler must be evaluating a task dependency that reads a task-written XCom value. Users of apache-airflow are recommended to upgrade to version 3.4.0 or later, which restricts dependency evaluation to primitive XCom values."}],"id":"CVE-2026-86829","lastModified":"2026-11-12T20:18:52.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86829","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:53:28.244272Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:13.757","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/72718"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/2qbt7qnclrlxtg3f1b685533r3mvk9hv"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/09/9"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-87755.json b/data/2026/CVE-2026-87755.json index d1475ed4fd..702aade4fe 100644 --- a/data/2026/CVE-2026-87755.json +++ b/data/2026/CVE-2026-87755.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-87755","lastModified":"2026-11-10T15:17:30.483","metrics":{},"published":"2026-11-10T15:17:30.483","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-340"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other users' session state. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-87755","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T15:17:30.483","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/srzp26oyjtb3bwgxwsyhpphv778s17m8"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-340"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-87756.json b/data/2026/CVE-2026-87756.json index c2639427f5..9a1416868e 100644 --- a/data/2026/CVE-2026-87756.json +++ b/data/2026/CVE-2026-87756.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.5.1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-87756","lastModified":"2026-11-10T15:17:30.603","metrics":{},"published":"2026-11-10T15:17:30.603","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/4748mnztpzyfcy840z143ttgj92yl84r"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.5.1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-87756","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T15:17:30.603","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/4748mnztpzyfcy840z143ttgj92yl84r"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-87758.json b/data/2026/CVE-2026-87758.json index d927530455..8552d41cf5 100644 --- a/data/2026/CVE-2026-87758.json +++ b/data/2026/CVE-2026-87758.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-client","packageURL":"pkg:maven/org.apache.openejb/openejb-client","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-client","packageURL":"pkg:maven/org.apache.tomee/openejb-client","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-87758","lastModified":"2026-11-10T16:17:24.930","metrics":{},"published":"2026-11-10T16:17:24.930","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/nzy4n8rmv4zl5wzdz0v0kwrj62tjrd7z"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-297"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-client","packageURL":"pkg:maven/org.apache.openejb/openejb-client","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-client","packageURL":"pkg:maven/org.apache.tomee/openejb-client","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-87758","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:24.930","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/nzy4n8rmv4zl5wzdz0v0kwrj62tjrd7z"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-297"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-87772.json b/data/2026/CVE-2026-87772.json index a6e44f7051..bc30ccaac6 100644 --- a/data/2026/CVE-2026-87772.json +++ b/data/2026/CVE-2026-87772.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pardus About","vendor":"TÜBİTAK BİLGEM Software Technologies Research Institute","versions":[{"lessThan":"1.2.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation.\n\nThis issue affects Pardus About: before 1.2.5."}],"id":"CVE-2026-87772","lastModified":"2026-11-12T07:16:47.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-12T07:16:47.580","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1521"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pardus About","vendor":"TÜBİTAK BİLGEM Software Technologies Research Institute","versions":[{"lessThan":"1.2.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation.\n\nThis issue affects Pardus About: before 1.2.5."}],"id":"CVE-2026-87772","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-12T07:16:47.580","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1521"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} diff --git a/data/2026/CVE-2026-87801.json b/data/2026/CVE-2026-87801.json index 1cd80b57bb..efc3353964 100644 --- a/data/2026/CVE-2026-87801.json +++ b/data/2026/CVE-2026-87801.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files."}],"id":"CVE-2026-87801","lastModified":"2026-11-12T04:17:21.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.950","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files."}],"id":"CVE-2026-87801","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:21.950","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-87857.json b/data/2026/CVE-2026-87857.json index 1cafe8aaed..4f97071751 100644 --- a/data/2026/CVE-2026-87857.json +++ b/data/2026/CVE-2026-87857.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pkg.go.dev","cpes":["cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["Frontend","History"],"packageName":"go.temporal.io/server","product":"Temporal Server","programFiles":["proto/internal/temporal/server/api/token/v1/message.proto","service/history/api/token.go","service/history/api/get_history_util.go","service/history/api/getworkflowexecutionhistory/api.go","service/history/api/getworkflowexecutionhistoryreverse/api.go"],"programRoutines":[{"name":"getworkflowexecutionhistory.Invoke"},{"name":"getworkflowexecutionhistoryreverse.Invoke"},{"name":"api.DeserializeHistoryToken"},{"name":"api.GetHistory"},{"name":"api.GetHistoryReverse"}],"repo":"https://github.com/temporalio/temporal","vendor":"Temporal Technologies, Inc.","versions":[{"lessThan":"1.0.0","status":"unknown","version":"0.0.0","versionType":"semver"},{"lessThanOrEqual":"1.29.7","status":"affected","version":"1.0.0","versionType":"semver"},{"lessThan":"1.30.7","status":"affected","version":"1.30.0","versionType":"semver"},{"lessThan":"1.31.3","status":"affected","version":"1.31.0","versionType":"semver"}]}],"source":"security@temporal.io"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace's workflow history, provided the supplied workflow identifier selects the same History shard as the continuation's branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller's current credential no longer granted access to the continuation's namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token's branch token is not the requested execution's current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading \"Pagination branch token is not the execution's current branch token\" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state."}],"id":"CVE-2026-87857","lastModified":"2026-11-09T20:18:14.997","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@temporal.io","type":"Secondary"}]},"published":"2026-11-09T20:18:14.997","references":[{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/blob/v1.0.0/service/frontend/workflowHandler.go#L602-L740"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/commit/4b02728735450dd60eaff9a5d0dc8e11fc8a4b13"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/commit/690b53103e11982de5f9187f722a0e0d3780028d"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/commit/c82a2d228e7287b1d283a55477f40a1a48481010"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/commit/ceb1cc1071b1fd37f8a2cd8ef5ed3e4333245cc2"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/pull/11723"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/pull/11919"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/pull/12039"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/pull/12040"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/releases/tag/v1.30.7"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/releases/tag/v1.31.3"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/releases/tag/v1.32.0"}],"sourceIdentifier":"security@temporal.io","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-863"}],"source":"security@temporal.io","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pkg.go.dev","cpes":["cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["Frontend","History"],"packageName":"go.temporal.io/server","product":"Temporal Server","programFiles":["proto/internal/temporal/server/api/token/v1/message.proto","service/history/api/token.go","service/history/api/get_history_util.go","service/history/api/getworkflowexecutionhistory/api.go","service/history/api/getworkflowexecutionhistoryreverse/api.go"],"programRoutines":[{"name":"getworkflowexecutionhistory.Invoke"},{"name":"getworkflowexecutionhistoryreverse.Invoke"},{"name":"api.DeserializeHistoryToken"},{"name":"api.GetHistory"},{"name":"api.GetHistoryReverse"}],"repo":"https://github.com/temporalio/temporal","vendor":"Temporal Technologies, Inc.","versions":[{"lessThan":"1.0.0","status":"unknown","version":"0.0.0","versionType":"semver"},{"lessThanOrEqual":"1.29.7","status":"affected","version":"1.0.0","versionType":"semver"},{"lessThan":"1.30.7","status":"affected","version":"1.30.0","versionType":"semver"},{"lessThan":"1.31.3","status":"affected","version":"1.31.0","versionType":"semver"}]}],"source":"security@temporal.io"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace's workflow history, provided the supplied workflow identifier selects the same History shard as the continuation's branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller's current credential no longer granted access to the continuation's namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token's branch token is not the requested execution's current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading \"Pagination branch token is not the execution's current branch token\" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state."}],"id":"CVE-2026-87857","lastModified":"2026-11-12T17:17:46.780","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@temporal.io","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-87857","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:49:08.520166Z","version":"2.0.3"}}]},"published":"2026-11-09T20:18:14.997","references":[{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/blob/v1.0.0/service/frontend/workflowHandler.go#L602-L740"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/commit/4b02728735450dd60eaff9a5d0dc8e11fc8a4b13"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/commit/690b53103e11982de5f9187f722a0e0d3780028d"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/commit/c82a2d228e7287b1d283a55477f40a1a48481010"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/commit/ceb1cc1071b1fd37f8a2cd8ef5ed3e4333245cc2"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/pull/11723"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/pull/11919"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/pull/12039"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/pull/12040"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/releases/tag/v1.30.7"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/releases/tag/v1.31.3"},{"source":"security@temporal.io","url":"https://github.com/temporalio/temporal/releases/tag/v1.32.0"}],"sourceIdentifier":"security@temporal.io","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-863"}],"source":"security@temporal.io","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-88266.json b/data/2026/CVE-2026-88266.json index 467368f989..23e835d39c 100644 --- a/data/2026/CVE-2026-88266.json +++ b/data/2026/CVE-2026-88266.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files."}],"id":"CVE-2026-88266","lastModified":"2026-11-12T04:17:22.093","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:22.093","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-15"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files."}],"id":"CVE-2026-88266","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:22.093","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-15"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-88707.json b/data/2026/CVE-2026-88707.json index 719c2520a3..c0152320b4 100644 --- a/data/2026/CVE-2026-88707.json +++ b/data/2026/CVE-2026-88707.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"3.0.0.4.386 series","versionType":"custom"},{"status":"affected","version":"3.0.0.4.388 series"},{"status":"affected","version":"3.0.0.6.102 series"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An\nout-of-bounds write in certain ASUS Router firmware\nallows an unauthenticated nearby user to send an HTTP request containing\nparameters that exceed the buffer length, potentially overwriting other memory\nregions or causing the system to crash.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-88707","lastModified":"2026-11-10T20:19:44.423","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:00.634555Z","version":"2.0.3"}}]},"published":"2026-11-10T02:16:45.513","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"3.0.0.4.386 series","versionType":"custom"},{"status":"affected","version":"3.0.0.4.388 series"},{"status":"affected","version":"3.0.0.6.102 series"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An\nout-of-bounds write in certain ASUS Router firmware\nallows an unauthenticated nearby user to send an HTTP request containing\nparameters that exceed the buffer length, potentially overwriting other memory\nregions or causing the system to crash.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-88707","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:00.634555Z","version":"2.0.3"}}]},"published":"2026-11-10T02:16:45.513","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-88708.json b/data/2026/CVE-2026-88708.json index 829a75665d..25c6ee1c59 100644 --- a/data/2026/CVE-2026-88708.json +++ b/data/2026/CVE-2026-88708.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"3.0.0.4.386 series","versionType":"custom"},{"status":"affected","version":"3.0.0.4.388 series"},{"status":"affected","version":"3.0.0.6.102 series"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An\noff-by-one error in certain ASUS Router firmware\nallows\nan unauthenticated nearby user to send a packet with a specific header\nlength, potentially overwriting memory and causing the\naffected service to crash.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-88708","lastModified":"2026-11-10T20:19:44.543","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:09.875879Z","version":"2.0.3"}}]},"published":"2026-11-10T02:16:45.680","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"3.0.0.4.386 series","versionType":"custom"},{"status":"affected","version":"3.0.0.4.388 series"},{"status":"affected","version":"3.0.0.6.102 series"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An\noff-by-one error in certain ASUS Router firmware\nallows\nan unauthenticated nearby user to send a packet with a specific header\nlength, potentially overwriting memory and causing the\naffected service to crash.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-88708","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:09.875879Z","version":"2.0.3"}}]},"published":"2026-11-10T02:16:45.680","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-88709.json b/data/2026/CVE-2026-88709.json index cb553f1257..b37265fa4c 100644 --- a/data/2026/CVE-2026-88709.json +++ b/data/2026/CVE-2026-88709.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"3.0.0.4.386 series","versionType":"custom"},{"status":"affected","version":"3.0.0.4.388 series"},{"status":"affected","version":"3.0.0.6.102 series"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper\nneutralization of special elements used in an OS command in certain\nASUS Router firmware allows an user with physical access\nto\ninsert a USB device containing a specially crafted directory name, potentially\nexecuting arbitrary commands with root privileges.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-88709","lastModified":"2026-11-10T20:19:44.657","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88709","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:34.026108Z","version":"2.0.3"}}]},"published":"2026-11-10T02:16:45.827","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"3.0.0.4.386 series","versionType":"custom"},{"status":"affected","version":"3.0.0.4.388 series"},{"status":"affected","version":"3.0.0.6.102 series"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper\nneutralization of special elements used in an OS command in certain\nASUS Router firmware allows an user with physical access\nto\ninsert a USB device containing a specially crafted directory name, potentially\nexecuting arbitrary commands with root privileges.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-88709","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88709","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:34.026108Z","version":"2.0.3"}}]},"published":"2026-11-10T02:16:45.827","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-88710.json b/data/2026/CVE-2026-88710.json index 93fbf6498c..9d536cb0fc 100644 --- a/data/2026/CVE-2026-88710.json +++ b/data/2026/CVE-2026-88710.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"3.0.0.4.386 series","versionType":"custom"},{"status":"affected","version":"3.0.0.4.388 series"},{"status":"affected","version":"3.0.0.6.102 series"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper\nneutralization of special elements used in an OS command in certain\nASUS Router firmware\nallows an unauthenticated nearby user to trigger a chain of\nactions—unauthenticated queries, identifier guessing, credential overwriting,\nand command injection—resulting in the execution of arbitrary commands with\nroot privileges.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-88710","lastModified":"2026-11-11T05:19:54.507","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88710","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T02:16:45.963","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Router firmware","vendor":"ASUS","versions":[{"status":"affected","version":"3.0.0.4.386 series","versionType":"custom"},{"status":"affected","version":"3.0.0.4.388 series"},{"status":"affected","version":"3.0.0.6.102 series"}]}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper\nneutralization of special elements used in an OS command in certain\nASUS Router firmware\nallows an unauthenticated nearby user to trigger a chain of\nactions—unauthenticated queries, identifier guessing, credential overwriting,\nand command injection—resulting in the execution of arbitrary commands with\nroot privileges.\nRefer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information."}],"id":"CVE-2026-88710","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88710","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T02:16:45.963","references":[{"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","url":"https://www.asus.com/security-advisory"}],"sourceIdentifier":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-88813.json b/data/2026/CVE-2026-88813.json index f02a34e700..de090cc5c3 100644 --- a/data/2026/CVE-2026-88813.json +++ b/data/2026/CVE-2026-88813.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"YITH WooCommerce Gift Cards","vendor":"Unknown","versions":[{"lessThanOrEqual":"4.39.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid."}],"id":"CVE-2026-88813","lastModified":"2026-11-11T12:20:00.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88813","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:15:21.060122Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:21.147","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/fc7e0837-640d-461d-aac3-cd58c8137c14/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"YITH WooCommerce Gift Cards","vendor":"Unknown","versions":[{"lessThanOrEqual":"4.39.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid."}],"id":"CVE-2026-88813","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88813","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:15:21.060122Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:21.147","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/fc7e0837-640d-461d-aac3-cd58c8137c14/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-89114.json b/data/2026/CVE-2026-89114.json index 0db555c162..3c456723ba 100644 --- a/data/2026/CVE-2026-89114.json +++ b/data/2026/CVE-2026-89114.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP NetWeaver AS Java EDM Application","vendor":"SAP_SE","versions":[{"status":"affected","version":"CE-RA-EDM 7.50"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability."}],"id":"CVE-2026-89114","lastModified":"2026-11-10T22:11:23.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Primary"}]},"published":"2026-11-10T01:17:21.757","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3810485"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"cna@sap.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP NetWeaver AS Java EDM Application","vendor":"SAP_SE","versions":[{"status":"affected","version":"CE-RA-EDM 7.50"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on confidentiality. There is no impact on integrity and availability."}],"id":"CVE-2026-89114","lastModified":"2026-11-12T18:17:53.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-89114","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:22:17.783589Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:21.757","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3810485"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"cna@sap.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-89115.json b/data/2026/CVE-2026-89115.json index ba919cdcb4..91092d4f65 100644 --- a/data/2026/CVE-2026-89115.json +++ b/data/2026/CVE-2026-89115.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP Start Service and SAP Microsoft Management Console","vendor":"SAP_SE","versions":[{"status":"affected","version":"HDB 2.00"},{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"CONTSERV 7.53"},{"status":"affected","version":"7.54"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.19"},{"status":"affected","version":"9.20"},{"status":"affected","version":"MMC 7.93"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability."}],"id":"CVE-2026-89115","lastModified":"2026-11-10T22:11:23.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"cna@sap.com","type":"Primary"}]},"published":"2026-11-10T01:17:21.927","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3740168"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-256"}],"source":"cna@sap.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP Start Service and SAP Microsoft Management Console","vendor":"SAP_SE","versions":[{"status":"affected","version":"HDB 2.00"},{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"CONTSERV 7.53"},{"status":"affected","version":"7.54"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.19"},{"status":"affected","version":"9.20"},{"status":"affected","version":"MMC 7.93"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability."}],"id":"CVE-2026-89115","lastModified":"2026-11-12T18:17:53.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-89115","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:23:45.486227Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:21.927","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3740168"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-256"}],"source":"cna@sap.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-89142.json b/data/2026/CVE-2026-89142.json index bac9c11441..29bc5f0b2e 100644 --- a/data/2026/CVE-2026-89142.json +++ b/data/2026/CVE-2026-89142.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["Wi-Fi NPU FW"],"product":"EN7529, AN7552, AN7581, AN7583 (Wi-Fi NPU Firmware)","vendor":"Airoha Technology Corp.","versions":[{"lessThanOrEqual":"TLB7.8.0.0_v006","status":"affected","version":"0","versionType":"custom"}]}],"source":"34e3dd7a-f061-4e75-a5eb-9fce7dd970ab"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Wi-Fi NPU FW, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service with user execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-89142","lastModified":"2026-11-10T14:17:36.473","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"34e3dd7a-f061-4e75-a5eb-9fce7dd970ab","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-89142","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:59:02.879879Z","version":"2.0.3"}}]},"published":"2026-11-06T04:16:35.437","references":[{"source":"34e3dd7a-f061-4e75-a5eb-9fce7dd970ab","url":"https://www.airoha.com/product-security-bulletin#CVE-2026-89142"}],"sourceIdentifier":"34e3dd7a-f061-4e75-a5eb-9fce7dd970ab","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"34e3dd7a-f061-4e75-a5eb-9fce7dd970ab","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["Wi-Fi NPU FW"],"product":"EN7529, AN7552, AN7581, AN7583 (Wi-Fi NPU Firmware)","vendor":"Airoha Technology Corp.","versions":[{"lessThanOrEqual":"TLB7.8.0.0_v006","status":"affected","version":"0","versionType":"custom"}]}],"source":"34e3dd7a-f061-4e75-a5eb-9fce7dd970ab"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Wi-Fi NPU FW, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service with user execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-89142","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"34e3dd7a-f061-4e75-a5eb-9fce7dd970ab","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-89142","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:59:02.879879Z","version":"2.0.3"}}]},"published":"2026-11-06T04:16:35.437","references":[{"source":"34e3dd7a-f061-4e75-a5eb-9fce7dd970ab","url":"https://www.airoha.com/product-security-bulletin#CVE-2026-89142"}],"sourceIdentifier":"34e3dd7a-f061-4e75-a5eb-9fce7dd970ab","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"34e3dd7a-f061-4e75-a5eb-9fce7dd970ab","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-89326.json b/data/2026/CVE-2026-89326.json index e94e6fb225..0870ad1277 100644 --- a/data/2026/CVE-2026-89326.json +++ b/data/2026/CVE-2026-89326.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-bridge","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-bridge","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-89326","lastModified":"2026-11-11T19:17:46.617","metrics":{},"published":"2026-11-11T15:17:25.313","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/BATIK-1398"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/j52wbxhp9wmysor6kdyqjnjz7pqnsthj"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/21"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-bridge","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-bridge","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not compare the URL protocol\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-89326","lastModified":"2026-11-12T17:01:06.913","metrics":{},"published":"2026-11-11T15:17:25.313","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/BATIK-1398"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/j52wbxhp9wmysor6kdyqjnjz7pqnsthj"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/21"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-90436.json b/data/2026/CVE-2026-90436.json index 9b18a7b9ca..a993176984 100644 --- a/data/2026/CVE-2026-90436.json +++ b/data/2026/CVE-2026-90436.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","cpes":["cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"],"defaultStatus":"affected","packageName":"axis:axis","packageURL":"pkg:maven/axis/axis","product":"Apache Axis 1.x (EOL)","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.4","status":"affected","version":"0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","cpes":["cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"org.apache.axis:axis","packageURL":"pkg:maven/org.apache.axis/axis","product":"Apache Axis 1.x (EOL)","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.4","status":"affected","version":"0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"Apache Axis 1.x (EOL)","repo":"https://gitbox.apache.org/repos/asf/axis-axis1-java.git","vendor":"Apache Software Foundation","versions":[{"lessThan":"41f3b4e8d04e310ca81f86b92630ab2c11d608bd","status":"affected","version":"aac718c6035435d96b39d6aebb9c078a13af7cc8","versionType":"git"}]}],"source":"security@apache.org"}],"cveTags":[{"sourceIdentifier":"security@apache.org","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP carries a element, Axis loads the named class and, if a String element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.\n\n\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem."}],"id":"CVE-2026-90436","lastModified":"2026-11-10T19:21:35.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90436","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:37:06.862801Z","version":"2.0.3"}}]},"published":"2026-11-06T16:18:59.763","references":[{"source":"security@apache.org","url":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/12"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-470"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","cpes":["cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"],"defaultStatus":"affected","packageName":"axis:axis","packageURL":"pkg:maven/axis/axis","product":"Apache Axis 1.x (EOL)","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.4","status":"affected","version":"0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","cpes":["cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"org.apache.axis:axis","packageURL":"pkg:maven/org.apache.axis/axis","product":"Apache Axis 1.x (EOL)","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.4","status":"affected","version":"0","versionType":"maven"}]},{"defaultStatus":"unaffected","product":"Apache Axis 1.x (EOL)","repo":"https://gitbox.apache.org/repos/asf/axis-axis1-java.git","vendor":"Apache Software Foundation","versions":[{"lessThan":"41f3b4e8d04e310ca81f86b92630ab2c11d608bd","status":"affected","version":"aac718c6035435d96b39d6aebb9c078a13af7cc8","versionType":"git"}]}],"source":"security@apache.org"}],"cveTags":[{"sourceIdentifier":"security@apache.org","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP carries a element, Axis loads the named class and, if a String element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.\n\n\n\nAs Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem."}],"id":"CVE-2026-90436","lastModified":"2026-11-12T17:06:26.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90436","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:37:06.862801Z","version":"2.0.3"}}]},"published":"2026-11-06T16:18:59.763","references":[{"source":"security@apache.org","url":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/06/12"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-470"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-90585.json b/data/2026/CVE-2026-90585.json index be50040741..402d63cfdb 100644 --- a/data/2026/CVE-2026-90585.json +++ b/data/2026/CVE-2026-90585.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["drivers/serial/uart_renesas_ra_sci.c"],"programRoutines":[{"name":"uart_ra_sci_configure"},{"name":"uart_ra_sci_eri_isr"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"4.0.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Renesas RA SCI UART driver's receive-error ISR, uart_ra_sci_eri_isr() in drivers/serial/uart_renesas_ra_sci.c, acknowledged the error condition only when a Zephyr interrupt-driven callback had already been registered. With CONFIG_UART_INTERRUPT_DRIVEN=y and CONFIG_UART_ASYNC_API=n, if data->user_cb is NULL the ISR body is empty: the SCI error flags (SSR.ORER, SSR.FER, SSR.PER) are left set and the ICU event flag R_ICU->IELSR_b[eri_irq].IR is never cleared, so the interrupt re-pends immediately and the ISR is re-entered without end.\n\nThe error interrupt is masked at boot by uart_ra_sci_init(), but FSP's R_SCI_UART_Open() unconditionally re-enables it, and uart_ra_sci_configure() - the back end of the public uart_configure() API, enabled by default via CONFIG_UART_USE_RUNTIME_CONFIGURE - performs a Close()/Open() pair without re-masking it. Any runtime uart_configure() therefore leaves the error interrupt live regardless of whether a callback has been set, as does calling uart_irq_err_enable() on its own. An instance used with the polling API, or the window between uart_configure() and uart_irq_callback_user_data_set(), thus runs with the error interrupt unmasked and no callback registered.\n\nThe trigger is an ordinary receive line error - overrun, framing, parity, or a break condition - which is fully determined by the device attached to the serial link. A peer able to assert a break or transmit at a mismatched baud rate produces such an error at will, so a single frame is enough to enter the state.\n\nThe impact is availability only: the CPU is captured in the re-entering ISR and never returns to thread context, hanging the entire system until an external reset or hardware watchdog fires. There is no memory corruption or information disclosure. Builds using the asynchronous UART API are unaffected, because the fall-through to FSP's sci_uart_eri_isr() clears both the error flags and the pending IRQ."}],"id":"CVE-2026-90585","lastModified":"2026-11-09T22:18:56.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-09T22:18:56.657","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/acfc8ca181600e8ca3a13f94c96e7da89e1e86ce"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p99p-qqr7-mqcx"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["drivers/serial/uart_renesas_ra_sci.c"],"programRoutines":[{"name":"uart_ra_sci_configure"},{"name":"uart_ra_sci_eri_isr"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"4.0.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Renesas RA SCI UART driver's receive-error ISR, uart_ra_sci_eri_isr() in drivers/serial/uart_renesas_ra_sci.c, acknowledged the error condition only when a Zephyr interrupt-driven callback had already been registered. With CONFIG_UART_INTERRUPT_DRIVEN=y and CONFIG_UART_ASYNC_API=n, if data->user_cb is NULL the ISR body is empty: the SCI error flags (SSR.ORER, SSR.FER, SSR.PER) are left set and the ICU event flag R_ICU->IELSR_b[eri_irq].IR is never cleared, so the interrupt re-pends immediately and the ISR is re-entered without end.\n\nThe error interrupt is masked at boot by uart_ra_sci_init(), but FSP's R_SCI_UART_Open() unconditionally re-enables it, and uart_ra_sci_configure() - the back end of the public uart_configure() API, enabled by default via CONFIG_UART_USE_RUNTIME_CONFIGURE - performs a Close()/Open() pair without re-masking it. Any runtime uart_configure() therefore leaves the error interrupt live regardless of whether a callback has been set, as does calling uart_irq_err_enable() on its own. An instance used with the polling API, or the window between uart_configure() and uart_irq_callback_user_data_set(), thus runs with the error interrupt unmasked and no callback registered.\n\nThe trigger is an ordinary receive line error - overrun, framing, parity, or a break condition - which is fully determined by the device attached to the serial link. A peer able to assert a break or transmit at a mismatched baud rate produces such an error at will, so a single frame is enough to enter the state.\n\nThe impact is availability only: the CPU is captured in the re-entering ISR and never returns to thread context, hanging the entire system until an external reset or hardware watchdog fires. There is no memory corruption or information disclosure. Builds using the asynchronous UART API are unaffected, because the fall-through to FSP's sci_uart_eri_isr() clears both the error flags and the pending IRQ."}],"id":"CVE-2026-90585","lastModified":"2026-11-12T18:17:54.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:17:07.854312Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:56.657","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/acfc8ca181600e8ca3a13f94c96e7da89e1e86ce"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p99p-qqr7-mqcx"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-90586.json b/data/2026/CVE-2026-90586.json index 4be0eec960..654ce321fc 100644 --- a/data/2026/CVE-2026-90586.json +++ b/data/2026/CVE-2026-90586.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["arch/xtensa/core/ptables.c","arch/xtensa/core/thread.c"],"programRoutines":[{"name":"arch_mem_domain_thread_add"},{"name":"arch_new_thread"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.6.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during thread setup, while arch_mem_domain_thread_add() in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its \"this thread is migrating from another memory domain\" predicate. For a thread whose struct k_thread backing memory is not zeroed, the field holds stale data and the kernel takes the migration branch, passing that stale value to reset_region() as the base of a level-1 page table. The equivalent field on x86 is explicitly cleared in z_x86_userspace_prepare_thread() for exactly this reason; the Xtensa port adopted the predicate without the initialization.\n\nThe condition is reachable from an unprivileged user-mode thread on a build with CONFIG_XTENSA_MMU, CONFIG_USERSPACE and dynamically allocated kernel objects. k_object_alloc(K_OBJ_THREAD) is a system call and allocates the thread object from the caller's resource pool without zeroing it, and the k_thread_create() verifier accepts such an object while forcing the K_USER option, so the migration branch is taken whenever the recycled heap bytes at that offset are non-zero. Because a user thread can also allocate, fill and free other kernel objects from the same heap, the stale bytes are groomable rather than merely random.\n\nWalking the bogus table in region_map_update() performs an unguarded index into l2_page_tables_counter[], may copy from and write through the attacker-influenceable level-1 base in dup_l2_table_if_needed(), and finally writes a page-table entry through a second pointer read out of that memory — once per page of the new thread's stack. The result is out-of-bounds reads and writes executed in supervisor mode, ranging from an immediate kernel panic (observed as Xtensa EXCAUSE 13 on Intel ADSP DSP firmware with user threads) to corruption of kernel memory and escape from the user-mode sandbox."}],"id":"CVE-2026-90586","lastModified":"2026-11-09T22:18:56.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-09T22:18:56.813","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/c770d5c5d19bdb6ff0ae42f7c7e259bd92b17347"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-334c-qm73-x5mv"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-824"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["arch/xtensa/core/ptables.c","arch/xtensa/core/thread.c"],"programRoutines":[{"name":"arch_mem_domain_thread_add"},{"name":"arch_new_thread"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.6.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during thread setup, while arch_mem_domain_thread_add() in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its \"this thread is migrating from another memory domain\" predicate. For a thread whose struct k_thread backing memory is not zeroed, the field holds stale data and the kernel takes the migration branch, passing that stale value to reset_region() as the base of a level-1 page table. The equivalent field on x86 is explicitly cleared in z_x86_userspace_prepare_thread() for exactly this reason; the Xtensa port adopted the predicate without the initialization.\n\nThe condition is reachable from an unprivileged user-mode thread on a build with CONFIG_XTENSA_MMU, CONFIG_USERSPACE and dynamically allocated kernel objects. k_object_alloc(K_OBJ_THREAD) is a system call and allocates the thread object from the caller's resource pool without zeroing it, and the k_thread_create() verifier accepts such an object while forcing the K_USER option, so the migration branch is taken whenever the recycled heap bytes at that offset are non-zero. Because a user thread can also allocate, fill and free other kernel objects from the same heap, the stale bytes are groomable rather than merely random.\n\nWalking the bogus table in region_map_update() performs an unguarded index into l2_page_tables_counter[], may copy from and write through the attacker-influenceable level-1 base in dup_l2_table_if_needed(), and finally writes a page-table entry through a second pointer read out of that memory — once per page of the new thread's stack. The result is out-of-bounds reads and writes executed in supervisor mode, ranging from an immediate kernel panic (observed as Xtensa EXCAUSE 13 on Intel ADSP DSP firmware with user threads) to corruption of kernel memory and escape from the user-mode sandbox."}],"id":"CVE-2026-90586","lastModified":"2026-11-12T18:17:54.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:17:43.773985Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:56.813","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/c770d5c5d19bdb6ff0ae42f7c7e259bd92b17347"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-334c-qm73-x5mv"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-824"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-90587.json b/data/2026/CVE-2026-90587.json index 0938e1a8a9..204de6b804 100644 --- a/data/2026/CVE-2026-90587.json +++ b/data/2026/CVE-2026-90587.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/usb/host/usbh_class.c","subsys/usb/host/usbh_desc.c","subsys/usb/host/usbh_device.c"],"programRoutines":[{"name":"usbh_class_probe_device"},{"name":"usbh_desc_get_next_function"},{"name":"usbh_device_init"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor read, so the function returns success while having skipped usbh_device_set_configuration() — the only place udev->cfg_desc is allocated. The device structure is zero-initialised by usbh_device_alloc(), so udev->cfg_desc remains NULL.\n\nusbh_device_connect() treats the zero return as a successful enumeration and calls usbh_class_probe_device(), which starts its descriptor walk from udev->cfg_desc. usbh_desc_get_next_function() passes that NULL pointer to usbh_desc_is_valid(), whose only guard compares the caller-supplied size, so head->bLength is read through a NULL pointer.\n\nThe condition is triggered entirely by the attached peripheral: attaching a USB device (or any USB gadget emulating one) that reports bNumConfigurations = 0 reaches the defect directly from the UHC_EVT_DEV_CONNECTED_FS/_HS event handler in subsys/usb/host/usbh_core.c, with no authentication and no user interaction beyond the physical attachment.\n\nOn targets where page zero is unmapped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled this raises a fatal exception in the USB host thread, denying service to the host. Where address zero is readable, the descriptor walker instead parses low memory as a descriptor chain and can dispatch a class probe() with attacker-influenced values, causing further out-of-bounds reads through the still-NULL udev->cfg_desc in usbh_desc_get_iface(). No attacker-controlled write was identified, so the impact is availability plus a bounded out-of-bounds read. Note that CONFIG_USB_HOST_STACK is marked experimental."}],"id":"CVE-2026-90587","lastModified":"2026-11-09T22:18:57.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-09T22:18:56.970","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/04e4284b4c3d3cd41791d44d7c39361e268b4d02"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9pxv-6992-2g24"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/usb/host/usbh_class.c","subsys/usb/host/usbh_desc.c","subsys/usb/host/usbh_device.c"],"programRoutines":[{"name":"usbh_class_probe_device"},{"name":"usbh_desc_get_next_function"},{"name":"usbh_device_init"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor read, so the function returns success while having skipped usbh_device_set_configuration() — the only place udev->cfg_desc is allocated. The device structure is zero-initialised by usbh_device_alloc(), so udev->cfg_desc remains NULL.\n\nusbh_device_connect() treats the zero return as a successful enumeration and calls usbh_class_probe_device(), which starts its descriptor walk from udev->cfg_desc. usbh_desc_get_next_function() passes that NULL pointer to usbh_desc_is_valid(), whose only guard compares the caller-supplied size, so head->bLength is read through a NULL pointer.\n\nThe condition is triggered entirely by the attached peripheral: attaching a USB device (or any USB gadget emulating one) that reports bNumConfigurations = 0 reaches the defect directly from the UHC_EVT_DEV_CONNECTED_FS/_HS event handler in subsys/usb/host/usbh_core.c, with no authentication and no user interaction beyond the physical attachment.\n\nOn targets where page zero is unmapped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled this raises a fatal exception in the USB host thread, denying service to the host. Where address zero is readable, the descriptor walker instead parses low memory as a descriptor chain and can dispatch a class probe() with attacker-influenced values, causing further out-of-bounds reads through the still-NULL udev->cfg_desc in usbh_desc_get_iface(). No attacker-controlled write was identified, so the impact is availability plus a bounded out-of-bounds read. Note that CONFIG_USB_HOST_STACK is marked experimental."}],"id":"CVE-2026-90587","lastModified":"2026-11-12T18:17:54.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:18:32.385537Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:56.970","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/04e4284b4c3d3cd41791d44d7c39361e268b4d02"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9pxv-6992-2g24"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-90588.json b/data/2026/CVE-2026-90588.json index 10a6aa0e0b..5bfe382999 100644 --- a/data/2026/CVE-2026-90588.json +++ b/data/2026/CVE-2026-90588.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/net/lib/http/http_client.c"],"programRoutines":[{"name":"print_header_field"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"2.1.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser data-callback slice with a %s conversion: snprintk(output, len + 1, \"%s\", str). The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not NUL terminated. The size argument of snprintk() bounds only the destination, while the %s conversion measures the source first — lib/os/cbprintf_complete.c uses strlen() when no precision is given, and lib/os/cbprintf_nano.c uses strlen() unconditionally — so the read walks past the end of the header field and past the end of the receive buffer until it finds a zero byte.\n\nThe slice reaches the helper from on_url(), on_header_field() and on_header_value(), which the parser invokes on bytes that http_wait_data() read straight off the socket into the application-supplied recv_buf. A malicious or compromised HTTP server, or an attacker able to answer a plaintext request, therefore controls both the header field and the bytes that follow it in the buffer, and can guarantee that no zero byte appears before the buffer ends, forcing the over-read. The in-tree tests/net/lib/http_client suite reproduces the over-read under CONFIG_ASAN=y on an ordinary GET.\n\nThe impact is bounded. The whole helper body is compiled only when the HTTP client log module is explicitly set to Debug (CONFIG_NET_HTTP_LOG_LEVEL_DBG=y, which the global CONFIG_LOG_DEFAULT_LEVEL does not set), so default builds are unaffected. No out-of-bounds write occurs and none of the over-read bytes are emitted into the log, so there is no information disclosure; the consequence is an out-of-bounds read that can fault and panic the device where the buffer abuts an unmapped or MPU/MMU-protected region.\n\nThe fix copies exactly the len bytes the parser offered with memcpy() and terminates them, instead of relying on a %s conversion (a %.*s precision would not have sufficed, since cbprintf_nano.c measures the source in full before applying it)."}],"id":"CVE-2026-90588","lastModified":"2026-11-09T22:18:57.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-09T22:18:57.123","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/0b2d0c2609cb0a4cd5cd82d2471e9ce8e3a14a8d"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pmg7-7q9m-mx35"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/net/lib/http/http_client.c"],"programRoutines":[{"name":"print_header_field"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"2.1.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser data-callback slice with a %s conversion: snprintk(output, len + 1, \"%s\", str). The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not NUL terminated. The size argument of snprintk() bounds only the destination, while the %s conversion measures the source first — lib/os/cbprintf_complete.c uses strlen() when no precision is given, and lib/os/cbprintf_nano.c uses strlen() unconditionally — so the read walks past the end of the header field and past the end of the receive buffer until it finds a zero byte.\n\nThe slice reaches the helper from on_url(), on_header_field() and on_header_value(), which the parser invokes on bytes that http_wait_data() read straight off the socket into the application-supplied recv_buf. A malicious or compromised HTTP server, or an attacker able to answer a plaintext request, therefore controls both the header field and the bytes that follow it in the buffer, and can guarantee that no zero byte appears before the buffer ends, forcing the over-read. The in-tree tests/net/lib/http_client suite reproduces the over-read under CONFIG_ASAN=y on an ordinary GET.\n\nThe impact is bounded. The whole helper body is compiled only when the HTTP client log module is explicitly set to Debug (CONFIG_NET_HTTP_LOG_LEVEL_DBG=y, which the global CONFIG_LOG_DEFAULT_LEVEL does not set), so default builds are unaffected. No out-of-bounds write occurs and none of the over-read bytes are emitted into the log, so there is no information disclosure; the consequence is an out-of-bounds read that can fault and panic the device where the buffer abuts an unmapped or MPU/MMU-protected region.\n\nThe fix copies exactly the len bytes the parser offered with memcpy() and terminates them, instead of relying on a %s conversion (a %.*s precision would not have sufficed, since cbprintf_nano.c measures the source in full before applying it)."}],"id":"CVE-2026-90588","lastModified":"2026-11-12T18:17:54.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:19:09.345531Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:57.123","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/0b2d0c2609cb0a4cd5cd82d2471e9ce8e3a14a8d"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pmg7-7q9m-mx35"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-90589.json b/data/2026/CVE-2026-90589.json index a8e6ff9373..5389a32ce1 100644 --- a/data/2026/CVE-2026-90589.json +++ b/data/2026/CVE-2026-90589.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["kernel/thread.c"],"programRoutines":[{"name":"do_thread_cleanup"},{"name":"k_thread_abort_cleanup"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.7.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When CONFIG_THREAD_STACK_MEM_MAPPED is enabled, each thread stack is mapped into the kernel virtual address space with a guard page on either side, and the mapping is released during abort cleanup. k_thread_abort_cleanup() in kernel/thread.c has two paths: a deferred one for self-abort, which stashes the mapping in thread_cleanup_stack_addr/thread_cleanup_stack_sz, and an immediate one for a thread aborted by some other thread. The immediate path called do_thread_cleanup(), which ignored its thread argument and only ever unmapped the stashed address — a value populated exclusively by the self-abort path. The mapped stack of a thread aborted by another thread was therefore never unmapped.\n\nEvery k_thread_abort() of a non-current thread leaks the thread's stack region plus its two guard pages from the kernel virtual address space. Threads that end by returning from their entry function take the working self-abort path, so the leak is specific to explicit cancellation — k_thread_abort(), pthread_cancel(), osThreadTerminate(), or the kernel thread kill shell command. Both k_thread_create() and k_thread_abort() are system calls, so with CONFIG_USERSPACE an unprivileged user-mode thread that has been granted a thread object and a user-capable stack object can drive the leak from user mode, consuming a kernel-side resource it cannot otherwise touch.\n\nWith CONFIG_KERNEL_VM_SIZE defaulting to 8 MB, a few hundred create/abort cycles exhaust the runtime mapping region. k_mem_map_phys_guard() then returns NULL, and map_thread_stack() guards that only with __ASSERT_NO_MSG(), which is compiled out of production builds; thread creation proceeds to write through a NULL-derived stack base and faults in kernel mode. The impact is a persistent denial of service — a kernel fatal error requiring a reboot — with no memory disclosure or corruption, and it is limited to configurations where memory-mapped thread stacks are enabled (x86 targets with X86_MMU and demand paging disabled, where the option is implied by default)."}],"id":"CVE-2026-90589","lastModified":"2026-11-09T22:18:57.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-09T22:18:57.270","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/d9ec92ccb1d91f4ea5b15271d30169d5b27ba667"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xj93-xhq8-g5p4"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["kernel/thread.c"],"programRoutines":[{"name":"do_thread_cleanup"},{"name":"k_thread_abort_cleanup"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.7.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When CONFIG_THREAD_STACK_MEM_MAPPED is enabled, each thread stack is mapped into the kernel virtual address space with a guard page on either side, and the mapping is released during abort cleanup. k_thread_abort_cleanup() in kernel/thread.c has two paths: a deferred one for self-abort, which stashes the mapping in thread_cleanup_stack_addr/thread_cleanup_stack_sz, and an immediate one for a thread aborted by some other thread. The immediate path called do_thread_cleanup(), which ignored its thread argument and only ever unmapped the stashed address — a value populated exclusively by the self-abort path. The mapped stack of a thread aborted by another thread was therefore never unmapped.\n\nEvery k_thread_abort() of a non-current thread leaks the thread's stack region plus its two guard pages from the kernel virtual address space. Threads that end by returning from their entry function take the working self-abort path, so the leak is specific to explicit cancellation — k_thread_abort(), pthread_cancel(), osThreadTerminate(), or the kernel thread kill shell command. Both k_thread_create() and k_thread_abort() are system calls, so with CONFIG_USERSPACE an unprivileged user-mode thread that has been granted a thread object and a user-capable stack object can drive the leak from user mode, consuming a kernel-side resource it cannot otherwise touch.\n\nWith CONFIG_KERNEL_VM_SIZE defaulting to 8 MB, a few hundred create/abort cycles exhaust the runtime mapping region. k_mem_map_phys_guard() then returns NULL, and map_thread_stack() guards that only with __ASSERT_NO_MSG(), which is compiled out of production builds; thread creation proceeds to write through a NULL-derived stack base and faults in kernel mode. The impact is a persistent denial of service — a kernel fatal error requiring a reboot — with no memory disclosure or corruption, and it is limited to configurations where memory-mapped thread stacks are enabled (x86 targets with X86_MMU and demand paging disabled, where the option is implied by default)."}],"id":"CVE-2026-90589","lastModified":"2026-11-12T18:17:54.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:19:57.233279Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:57.270","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/d9ec92ccb1d91f4ea5b15271d30169d5b27ba667"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xj93-xhq8-g5p4"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-90590.json b/data/2026/CVE-2026-90590.json index 8c2ab69982..ce084d437d 100644 --- a/data/2026/CVE-2026-90590.json +++ b/data/2026/CVE-2026-90590.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["drivers/ethernet/eth_nxp_enet_qos/eth_nxp_enet_qos.c","drivers/ethernet/eth_nxp_enet_qos/eth_nxp_enet_qos_mac.c","drivers/ethernet/eth_nxp_enet_qos/nxp_enet_qos_priv.h"],"programRoutines":[{"name":"eth_nxp_enet_qos_phy_cb"},{"name":"eth_nxp_enet_qos_tx"},{"name":"tx_dma_done"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.7.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NXP ENET QoS Ethernet driver in drivers/ethernet/eth_nxp_enet_qos serialises transmission with a binary semaphore, data->tx.tx_sem, taken in eth_nxp_enet_qos_tx() and returned only by the transmit-completion interrupt handler tx_dma_done(). A frame that has been handed to the transmit DMA when the Ethernet link goes down is never written back, so that completion interrupt never arrives. The PHY callback eth_nxp_enet_qos_phy_cb() reacts to carrier loss only by calling net_eth_carrier_set(); it does not stop the DMA, take the descriptors back or release the outstanding frame, and no timeout exists to do so.\n\nThe trigger is a link-down/link-up transition that lands while a frame is under the transmit DMA. It can be produced by anyone who controls the link partner or the cable — for example by administratively downing and restoring the attached switch port, or by restarting auto-negotiation from a peer device — and can be made reliable by generating traffic that keeps the device transmitting and repeating the transition. No credentials or user interaction are required, and the trigger is at the link layer rather than over IP.\n\nBecause the semaphore is never given back, every subsequent call to eth_nxp_enet_qos_tx() fails with -EBUSY for the remaining life of the boot; restoring the link does not recover the interface, since the link-up path only rewrites MAC_CONFIGURATION. The affected interface continues to receive but can no longer transmit anything — no ARP replies, no TCP acknowledgements, no DHCP renewals — until the device is reset. The net_pkt and the net_buf fragments of the abandoned frame are likewise never unreferenced and never return to their pools. The security-relevant property is persistence: a momentary link flap leaves the interface permanently unable to send, so the denial of service outlasts the attacker's access to the link. There is no confidentiality or integrity impact.\n\nThe fix adds a claim/release pair around the outstanding packet so that completion and abandonment are mutually exclusive, aborts an outstanding frame from the PHY callback on carrier loss (stopping the DMA, flushing the MTL transmit queue and reinitialising the descriptor ring), and arms a transmit watchdog, CONFIG_ETH_NXP_ENET_QOS_TX_TIMEOUT_MS, so that any non-completing DMA — not only a carrier loss — reclaims the transmit slot and the packet."}],"id":"CVE-2026-90590","lastModified":"2026-11-09T22:18:57.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-09T22:18:57.417","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/b099a89cf2a06b410c91f8cd8453d2d0cd2d6fed"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-996m-g5pm-w3gv"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["drivers/ethernet/eth_nxp_enet_qos/eth_nxp_enet_qos.c","drivers/ethernet/eth_nxp_enet_qos/eth_nxp_enet_qos_mac.c","drivers/ethernet/eth_nxp_enet_qos/nxp_enet_qos_priv.h"],"programRoutines":[{"name":"eth_nxp_enet_qos_phy_cb"},{"name":"eth_nxp_enet_qos_tx"},{"name":"tx_dma_done"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.7.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NXP ENET QoS Ethernet driver in drivers/ethernet/eth_nxp_enet_qos serialises transmission with a binary semaphore, data->tx.tx_sem, taken in eth_nxp_enet_qos_tx() and returned only by the transmit-completion interrupt handler tx_dma_done(). A frame that has been handed to the transmit DMA when the Ethernet link goes down is never written back, so that completion interrupt never arrives. The PHY callback eth_nxp_enet_qos_phy_cb() reacts to carrier loss only by calling net_eth_carrier_set(); it does not stop the DMA, take the descriptors back or release the outstanding frame, and no timeout exists to do so.\n\nThe trigger is a link-down/link-up transition that lands while a frame is under the transmit DMA. It can be produced by anyone who controls the link partner or the cable — for example by administratively downing and restoring the attached switch port, or by restarting auto-negotiation from a peer device — and can be made reliable by generating traffic that keeps the device transmitting and repeating the transition. No credentials or user interaction are required, and the trigger is at the link layer rather than over IP.\n\nBecause the semaphore is never given back, every subsequent call to eth_nxp_enet_qos_tx() fails with -EBUSY for the remaining life of the boot; restoring the link does not recover the interface, since the link-up path only rewrites MAC_CONFIGURATION. The affected interface continues to receive but can no longer transmit anything — no ARP replies, no TCP acknowledgements, no DHCP renewals — until the device is reset. The net_pkt and the net_buf fragments of the abandoned frame are likewise never unreferenced and never return to their pools. The security-relevant property is persistence: a momentary link flap leaves the interface permanently unable to send, so the denial of service outlasts the attacker's access to the link. There is no confidentiality or integrity impact.\n\nThe fix adds a claim/release pair around the outstanding packet so that completion and abandonment are mutually exclusive, aborts an outstanding frame from the PHY callback on carrier loss (stopping the DMA, flushing the MTL transmit queue and reinitialising the descriptor ring), and arms a transmit watchdog, CONFIG_ETH_NXP_ENET_QOS_TX_TIMEOUT_MS, so that any non-completing DMA — not only a carrier loss — reclaims the transmit slot and the packet."}],"id":"CVE-2026-90590","lastModified":"2026-11-12T18:17:54.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:20:33.548786Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:57.417","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/b099a89cf2a06b410c91f8cd8453d2d0cd2d6fed"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-996m-g5pm-w3gv"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-90591.json b/data/2026/CVE-2026-90591.json index 8f048caca8..b5bccb13f5 100644 --- a/data/2026/CVE-2026-90591.json +++ b/data/2026/CVE-2026-90591.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["drivers/ethernet/eth_nxp_enet_qos/eth_nxp_enet_qos.c","drivers/ethernet/eth_nxp_enet_qos/eth_nxp_enet_qos_mac.c"],"programRoutines":[{"name":"eth_nxp_enet_qos_rx"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"4.2.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NXP ENET-QOS Ethernet driver's receive work handler eth_nxp_enet_qos_rx() in drivers/ethernet/eth_nxp_enet_qos hands each processed descriptor back to the DMA by writing desc->read.control = rx_desc_refresh_flags, which sets OWN_FLAG and BUF1_ADDR_VALID_FLAG. RDES0 of a receive descriptor is the DMA buffer address in read format, but the hardware write-back aliases that word with the VLAN tag fields (or, for a context descriptor, the timestamp low word), so it is destroyed on every completion. The success path rewrites desc->read.buf1_addr before re-arming; the four drop paths — errored or non-first descriptor, net_pkt_rx_alloc() failure, invalid descriptor length, and net_pkt_get_frag() failure — did not, re-arming the ring slot with the write-back residue as its DMA target address.\n\nThe drop paths are driven entirely by received traffic and need no privilege or special configuration. With the defaults for this driver (CONFIG_NET_BUF_DATA_SIZE of 128 and 16 receive descriptors) a single full-size frame consumes twelve ring slots and twelve K_NO_WAIT fragment allocations, so a short burst of frames sent to the device exhausts the receive pools and reaches the allocation-failure paths; a frame with a receive error, or any frame whose first descriptor was already dropped, reaches the non-first-descriptor path.\n\nOnce a slot has been poisoned, the DMA writes the next frame received in that slot to an address derived from the frame's VLAN tag fields rather than to a receive buffer. On the supported MCX SoCs that address falls in flash or reserved space, so the transfer raises a fatal bus error that the driver only logs — there is no reset or recovery path — and reception stops permanently until the device is rebooted; where the write is silently discarded instead, the untouched buffer is later handed to the network stack with a length, delivering stale buffer contents as if they were a received frame. A single triggering event is enough to make the condition persistent, so an attacker able to send traffic to the device can permanently disable its network interface."}],"id":"CVE-2026-90591","lastModified":"2026-11-09T22:18:57.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-09T22:18:57.573","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/9efd144a4ab0f37311f7b5e5ed0967f5a8d2f910"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pm7x-98w8-92pm"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["drivers/ethernet/eth_nxp_enet_qos/eth_nxp_enet_qos.c","drivers/ethernet/eth_nxp_enet_qos/eth_nxp_enet_qos_mac.c"],"programRoutines":[{"name":"eth_nxp_enet_qos_rx"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"4.2.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NXP ENET-QOS Ethernet driver's receive work handler eth_nxp_enet_qos_rx() in drivers/ethernet/eth_nxp_enet_qos hands each processed descriptor back to the DMA by writing desc->read.control = rx_desc_refresh_flags, which sets OWN_FLAG and BUF1_ADDR_VALID_FLAG. RDES0 of a receive descriptor is the DMA buffer address in read format, but the hardware write-back aliases that word with the VLAN tag fields (or, for a context descriptor, the timestamp low word), so it is destroyed on every completion. The success path rewrites desc->read.buf1_addr before re-arming; the four drop paths — errored or non-first descriptor, net_pkt_rx_alloc() failure, invalid descriptor length, and net_pkt_get_frag() failure — did not, re-arming the ring slot with the write-back residue as its DMA target address.\n\nThe drop paths are driven entirely by received traffic and need no privilege or special configuration. With the defaults for this driver (CONFIG_NET_BUF_DATA_SIZE of 128 and 16 receive descriptors) a single full-size frame consumes twelve ring slots and twelve K_NO_WAIT fragment allocations, so a short burst of frames sent to the device exhausts the receive pools and reaches the allocation-failure paths; a frame with a receive error, or any frame whose first descriptor was already dropped, reaches the non-first-descriptor path.\n\nOnce a slot has been poisoned, the DMA writes the next frame received in that slot to an address derived from the frame's VLAN tag fields rather than to a receive buffer. On the supported MCX SoCs that address falls in flash or reserved space, so the transfer raises a fatal bus error that the driver only logs — there is no reset or recovery path — and reception stops permanently until the device is rebooted; where the write is silently discarded instead, the untouched buffer is later handed to the network stack with a length, delivering stale buffer contents as if they were a received frame. A single triggering event is enough to make the condition persistent, so an attacker able to send traffic to the device can permanently disable its network interface."}],"id":"CVE-2026-90591","lastModified":"2026-11-12T18:17:55.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90591","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:21:18.487341Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:57.573","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/9efd144a4ab0f37311f7b5e5ed0967f5a8d2f910"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pm7x-98w8-92pm"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-9063.json b/data/2026/CVE-2026-9063.json index 9f34e48815..24cbc008af 100644 --- a/data/2026/CVE-2026-9063.json +++ b/data/2026/CVE-2026-9063.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.80","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"13.0.14","status":"affected","version":"13.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authenticating with an admin-privileged service account."}],"id":"CVE-2026-9063","lastModified":"2026-11-10T06:17:10.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"product-security@axis.com","type":"Secondary"}]},"published":"2026-11-10T06:17:10.623","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/37/e2/7c/cve-2026-9063pdf-en-US-561254.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"product-security@axis.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AXIS OS","vendor":"Axis Communications AB","versions":[{"lessThan":"12.11.80","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"13.0.14","status":"affected","version":"13.0.0","versionType":"semver"}]}],"source":"product-security@axis.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authenticating with an admin-privileged service account."}],"id":"CVE-2026-9063","lastModified":"2026-11-12T19:26:10.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"product-security@axis.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-9063","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:29:26.661310Z","version":"2.0.3"}}]},"published":"2026-11-10T06:17:10.623","references":[{"source":"product-security@axis.com","url":"https://www.axis.com/dam/public/37/e2/7c/cve-2026-9063pdf-en-US-561254.pdf"}],"sourceIdentifier":"product-security@axis.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"product-security@axis.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-90975.json b/data/2026/CVE-2026-90975.json index a31cd8c0f6..3e4f3a3f10 100644 --- a/data/2026/CVE-2026-90975.json +++ b/data/2026/CVE-2026-90975.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"RtUsbA64.sys","vendor":"Realtek","versions":[{"status":"affected","version":"6.3.9600.2393"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution."}],"id":"CVE-2026-90975","lastModified":"2026-11-10T19:21:35.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90975","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:22:27.974732Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:59.147","references":[{"source":"cret@cert.org","url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-90975"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.kb.cert.org/vuls/id/701544"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"RtUsbA64.sys","vendor":"Realtek","versions":[{"status":"affected","version":"6.3.9600.2393"}]}],"source":"cret@cert.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution."}],"id":"CVE-2026-90975","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90975","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:22:27.974732Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:59.147","references":[{"source":"cret@cert.org","url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-90975"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.kb.cert.org/vuls/id/701544"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-90993.json b/data/2026/CVE-2026-90993.json index 61f990558b..cca7db44ef 100644 --- a/data/2026/CVE-2026-90993.json +++ b/data/2026/CVE-2026-90993.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-dom","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-dom","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"XXE vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-90993","lastModified":"2026-11-11T19:17:46.743","metrics":{},"published":"2026-11-11T11:17:22.293","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/BATIK-1399"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/cnl5g2os5w048h32x50v1xgjnyo8y6vs"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/20"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.xmlgraphics:batik-dom","packageURL":"pkg:maven/org.apache.xmlgraphics/batik-dom","product":"Apache XML Graphics Batik","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"1.19.0","status":"affected","version":"0","versionType":"maven"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"XXE vulnerability in Apache XML Graphics Batik.\n\n\n\nThis issue affects Apache XML Graphics Batik: through 1.19.\n\n\n\nUsers are recommended to upgrade to version 1.20, which fixes the issue."}],"id":"CVE-2026-90993","lastModified":"2026-11-12T17:01:06.913","metrics":{},"published":"2026-11-11T11:17:22.293","references":[{"source":"security@apache.org","url":"https://issues.apache.org/jira/browse/BATIK-1399"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/cnl5g2os5w048h32x50v1xgjnyo8y6vs"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/20"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91150.json b/data/2026/CVE-2026-91150.json index a51623b07a..55eb0159f7 100644 --- a/data/2026/CVE-2026-91150.json +++ b/data/2026/CVE-2026-91150.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:310.10.2-1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:356.4.1-1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service."}],"id":"CVE-2026-91150","lastModified":"2026-11-12T14:17:30.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.043","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99600"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99601"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99602"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99603"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-91150"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478436"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/commit/4bc66ac3e5b4923528f1ac89517a009b7bc90f93"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/releases/tag/372"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:356.4.1-1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:310.10.2-1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:356.4.1-1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service."}],"id":"CVE-2026-91150","lastModified":"2026-11-12T17:17:47.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.043","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99599"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99600"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99601"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99602"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99603"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-91150"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478436"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/commit/4bc66ac3e5b4923528f1ac89517a009b7bc90f93"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/releases/tag/372"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91151.json b/data/2026/CVE-2026-91151.json index dcbf36e8c1..f25c637abc 100644 --- a/data/2026/CVE-2026-91151.json +++ b/data/2026/CVE-2026-91151.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:310.10.2-1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:356.4.1-1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system."}],"id":"CVE-2026-91151","lastModified":"2026-11-12T14:17:30.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-11T20:17:10.557","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99600"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99601"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99602"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99603"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-91151"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478404"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/releases/tag/372"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:356.4.1-1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:310.10.2-1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:356.4.1-1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system."}],"id":"CVE-2026-91151","lastModified":"2026-11-12T17:17:47.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-11T20:17:10.557","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99599"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99600"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99601"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99602"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99603"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-91151"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478404"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/releases/tag/372"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-9165.json b/data/2026/CVE-2026-9165.json index 6a5c890a49..acfde14e2f 100644 --- a/data/2026/CVE-2026-9165.json +++ b/data/2026/CVE-2026-9165.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.9::el8"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-main-rhel8","product":"Red Hat Advanced Cluster Security 4.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783357116","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.10::el8"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-main-rhel8","product":"Red Hat Advanced Cluster Security for Kubernetes 4.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783357140","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.11::el9"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-main-rhel9","product":"Red Hat Advanced Cluster Security for Kubernetes 4.11","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783352589","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-main-rhel11","product":"Red Hat Advanced Cluster Security 4","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane."},{"lang":"es","value":"Se ha detectado una vulnerabilidad en Red Hat Advanced Cluster Security para Kubernetes (RHACS). Central no limita la profundidad de las consultas GraphQL que se sirven en la API GraphQL autenticada. Un usuario autenticado con un token de API válido puede enviar consultas profundamente anidadas que provocan un consumo excesivo de recursos en Central, lo que da lugar a una denegación de servicio en el plano de gestión."}],"id":"CVE-2026-9165","lastModified":"2026-09-08T08:17:13.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-9165","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-07T14:00:57.848857Z","version":"2.0.3"}}]},"published":"2026-07-06T09:16:39.400","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:36207"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:36319"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:36625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-9165"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480505"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.9::el8"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-main-rhel8","product":"Red Hat Advanced Cluster Security 4.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783357116","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.11::el9"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-main-rhel9","product":"Red Hat Advanced Cluster Security for Kubernetes 4.11","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783352589","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.10::el8"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-main-rhel8","product":"Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783357140","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:advanced_cluster_security:4"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-main-rhel11","product":"Red Hat Advanced Cluster Security 4","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane."},{"lang":"es","value":"Se ha detectado una vulnerabilidad en Red Hat Advanced Cluster Security para Kubernetes (RHACS). Central no limita la profundidad de las consultas GraphQL que se sirven en la API GraphQL autenticada. Un usuario autenticado con un token de API válido puede enviar consultas profundamente anidadas que provocan un consumo excesivo de recursos en Central, lo que da lugar a una denegación de servicio en el plano de gestión."}],"id":"CVE-2026-9165","lastModified":"2026-11-12T17:17:48.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-9165","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-07T14:00:57.848857Z","version":"2.0.3"}}]},"published":"2026-07-06T09:16:39.400","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:36207"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:36319"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:36625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-9165"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480505"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91870.json b/data/2026/CVE-2026-91870.json index 6cce08bcff..6aa49c0ab4 100644 --- a/data/2026/CVE-2026-91870.json +++ b/data/2026/CVE-2026-91870.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ansible Storage for PowerFlex","vendor":"Dell","versions":[{"lessThan":"3.2.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Ansible Storage for PowerFlex, versions prior to 3.2.0, contains an Improper Certificate Validation vulnerability in the API client component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91870","lastModified":"2026-11-11T18:19:53.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:53.087","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-au/000515361/dsa-2026-431-security-update-for-dell-ansible-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ansible Storage for PowerFlex","vendor":"Dell","versions":[{"lessThan":"3.2.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Ansible Storage for PowerFlex, versions prior to 3.2.0, contains an Improper Certificate Validation vulnerability in the API client component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91870","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:53.087","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-au/000515361/dsa-2026-431-security-update-for-dell-ansible-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-91871.json b/data/2026/CVE-2026-91871.json index e08b09a68e..cda383f82d 100644 --- a/data/2026/CVE-2026-91871.json +++ b/data/2026/CVE-2026-91871.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ansible Storage for PowerStore","vendor":"Dell","versions":[{"lessThan":"3.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Ansible Storage for PowerStore, versions prior to 3.9.0, contains an Improper Certificate Validation vulnerability in the API client component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91871","lastModified":"2026-11-11T18:19:53.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:53.223","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-au/000515361/dsa-2026-431-security-update-for-dell-ansible-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ansible Storage for PowerStore","vendor":"Dell","versions":[{"lessThan":"3.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Ansible Storage for PowerStore, versions prior to 3.9.0, contains an Improper Certificate Validation vulnerability in the API client component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91871","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91871","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:23:23.301945Z","version":"2.0.3"}}]},"published":"2026-11-11T18:19:53.223","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-au/000515361/dsa-2026-431-security-update-for-dell-ansible-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91872.json b/data/2026/CVE-2026-91872.json index 54473f6ba7..d873d0bf63 100644 --- a/data/2026/CVE-2026-91872.json +++ b/data/2026/CVE-2026-91872.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ansible Storage for PowerStore","vendor":"Dell","versions":[{"lessThan":"3.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Ansible Storage for PowerStore, versions prior to 3.9.0,contains an Insertion of Sensitive Information into Log File vulnerability in the configuration module. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure."}],"id":"CVE-2026-91872","lastModified":"2026-11-11T18:19:53.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:53.347","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-au/000515361/dsa-2026-431-security-update-for-dell-ansible-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ansible Storage for PowerStore","vendor":"Dell","versions":[{"lessThan":"3.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Ansible Storage for PowerStore, versions prior to 3.9.0,contains an Insertion of Sensitive Information into Log File vulnerability in the configuration module. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure."}],"id":"CVE-2026-91872","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91872","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:09.704911Z","version":"2.0.3"}}]},"published":"2026-11-11T18:19:53.347","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-au/000515361/dsa-2026-431-security-update-for-dell-ansible-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91873.json b/data/2026/CVE-2026-91873.json index 6487cd1af7..c37731471d 100644 --- a/data/2026/CVE-2026-91873.json +++ b/data/2026/CVE-2026-91873.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91873","lastModified":"2026-11-11T19:17:47.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.230","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91873","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.230","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-91874.json b/data/2026/CVE-2026-91874.json index 72787b8b1b..577c1192d5 100644 --- a/data/2026/CVE-2026-91874.json +++ b/data/2026/CVE-2026-91874.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 5.0.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACConnection component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91874","lastModified":"2026-11-11T19:17:47.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.373","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 5.0.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACConnection component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91874","lastModified":"2026-11-12T20:18:53.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91874","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:40:27.438177Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:47.373","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91875.json b/data/2026/CVE-2026-91875.json index 491ebe8815..e46092a91d 100644 --- a/data/2026/CVE-2026-91875.json +++ b/data/2026/CVE-2026-91875.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 9.2.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the SessionAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91875","lastModified":"2026-11-11T19:17:47.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.513","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 9.2.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the SessionAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91875","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.513","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-91876.json b/data/2026/CVE-2026-91876.json index c58781367b..77e70fbe49 100644 --- a/data/2026/CVE-2026-91876.json +++ b/data/2026/CVE-2026-91876.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure."}],"id":"CVE-2026-91876","lastModified":"2026-11-11T19:17:47.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.647","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure."}],"id":"CVE-2026-91876","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91876","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:22:41.234734Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:47.647","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91877.json b/data/2026/CVE-2026-91877.json index 9f42c5e1fa..a4f2affa17 100644 --- a/data/2026/CVE-2026-91877.json +++ b/data/2026/CVE-2026-91877.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements in Data Query Logic vulnerability in the OData filter processing component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized data access, authorization bypass, and denial of service."}],"id":"CVE-2026-91877","lastModified":"2026-11-11T19:17:47.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.773","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-943"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements in Data Query Logic vulnerability in the OData filter processing component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized data access, authorization bypass, and denial of service."}],"id":"CVE-2026-91877","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91877","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:27:16.645392Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:47.773","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-943"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91878.json b/data/2026/CVE-2026-91878.json index 07dffb7c48..0657562578 100644 --- a/data/2026/CVE-2026-91878.json +++ b/data/2026/CVE-2026-91878.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the XML data conversion component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to XML injection, malicious content injection, and XML parsing errors"}],"id":"CVE-2026-91878","lastModified":"2026-11-11T19:17:47.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.917","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the XML data conversion component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to XML injection, malicious content injection, and XML parsing errors"}],"id":"CVE-2026-91878","lastModified":"2026-11-12T20:18:53.677","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:40:52.252571Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:47.917","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91879.json b/data/2026/CVE-2026-91879.json index bf5d78f366..61ad3f623e 100644 --- a/data/2026/CVE-2026-91879.json +++ b/data/2026/CVE-2026-91879.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for ObjectScale","vendor":"Dell","versions":[{"lessThan":"1.1.1 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Terraform Provider for PowerStore","vendor":"Dell","versions":[{"lessThan":"1.3.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component.  A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91879","lastModified":"2026-11-11T18:19:53.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:53.483","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for ObjectScale","vendor":"Dell","versions":[{"lessThan":"1.1.1 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Terraform Provider for PowerStore","vendor":"Dell","versions":[{"lessThan":"1.3.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component.  A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91879","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:53.483","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-91880.json b/data/2026/CVE-2026-91880.json index 8e1b845d8f..f2e3cb16df 100644 --- a/data/2026/CVE-2026-91880.json +++ b/data/2026/CVE-2026-91880.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for PowerFlex","vendor":"Dell","versions":[{"lessThan":"1.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91880","lastModified":"2026-11-11T19:17:48.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":6.0,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:48.063","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for PowerFlex","vendor":"Dell","versions":[{"lessThan":"1.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH client component.Terraform PowerFlex provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91880","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":6.0,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91880","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:21:04.288816Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:48.063","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91890.json b/data/2026/CVE-2026-91890.json index c85e124955..c0241042da 100644 --- a/data/2026/CVE-2026-91890.json +++ b/data/2026/CVE-2026-91890.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ansible Storage for Unity","vendor":"Dell","versions":[{"lessThan":"1.2.13 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in the UnityRESTConnector component. An unauthenticated attacker with remote access could potentially exploit this vulnerability,leading to information exposure and unauthorized access."}],"id":"CVE-2026-91890","lastModified":"2026-11-11T18:19:53.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:53.627","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-au/000515361/dsa-2026-431-security-update-for-dell-ansible-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ansible Storage for Unity","vendor":"Dell","versions":[{"lessThan":"1.2.13 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in the UnityRESTConnector component. An unauthenticated attacker with remote access could potentially exploit this vulnerability,leading to information exposure and unauthorized access."}],"id":"CVE-2026-91890","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:53.627","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-au/000515361/dsa-2026-431-security-update-for-dell-ansible-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-91891.json b/data/2026/CVE-2026-91891.json index 8e4497a581..2463a78bdd 100644 --- a/data/2026/CVE-2026-91891.json +++ b/data/2026/CVE-2026-91891.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for PowerStore","vendor":"Dell","versions":[{"lessThan":"1.3.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a  vulnerability that may cause sensitive authentication data to be insufficiently redacted in diagnostic logs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure."}],"id":"CVE-2026-91891","lastModified":"2026-11-11T19:17:48.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:48.213","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for PowerStore","vendor":"Dell","versions":[{"lessThan":"1.3.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a  vulnerability that may cause sensitive authentication data to be insufficiently redacted in diagnostic logs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure."}],"id":"CVE-2026-91891","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91891","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:38:08.147707Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:48.213","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-91892.json b/data/2026/CVE-2026-91892.json index 6c4d38fbd1..6216c44387 100644 --- a/data/2026/CVE-2026-91892.json +++ b/data/2026/CVE-2026-91892.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for PowerFlex","vendor":"Dell","versions":[{"lessThan":"1.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability  that may permit the use of deprecated cryptographic protocols during secure communications. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure."}],"id":"CVE-2026-91892","lastModified":"2026-11-11T19:17:48.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:48.477","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-326"}],"source":"security_alert@emc.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for PowerFlex","vendor":"Dell","versions":[{"lessThan":"1.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability  that may permit the use of deprecated cryptographic protocols during secure communications. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure."}],"id":"CVE-2026-91892","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:48.477","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-326"}],"source":"security_alert@emc.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-92083.json b/data/2026/CVE-2026-92083.json index 0b322da6cf..2043bd2ce9 100644 --- a/data/2026/CVE-2026-92083.json +++ b/data/2026/CVE-2026-92083.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"pardus-image-writer","vendor":"TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü","versions":[{"lessThan":"0.9.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pardus-image-writer allows Privilege Escalation.\n\nThis issue affects pardus-image-writer: before 0.9.0."}],"id":"CVE-2026-92083","lastModified":"2026-11-12T14:17:30.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-12T14:17:30.737","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1532"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"pardus-image-writer","vendor":"TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü","versions":[{"lessThan":"0.9.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pardus-image-writer allows Privilege Escalation.\n\nThis issue affects pardus-image-writer: before 0.9.0."}],"id":"CVE-2026-92083","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-12T14:17:30.737","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1532"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} diff --git a/data/2026/CVE-2026-92211.json b/data/2026/CVE-2026-92211.json index a26adb51a1..17949868d3 100644 --- a/data/2026/CVE-2026-92211.json +++ b/data/2026/CVE-2026-92211.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"OpenUSD","vendor":"Pixar Animation Studio","versions":[{"status":"affected","version":"v26.03"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30428."}],"id":"CVE-2026-92211","lastModified":"2026-11-06T19:18:01.227","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92211","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T18:56:55.251051Z","version":"2.0.3"}}]},"published":"2026-11-04T00:17:31.273","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://github.com/PixarAnimationStudios/OpenUSD/commit/7c62a43d8823dd4e1ef8c49fc1d72729e1ce6e36"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-791/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"OpenUSD","vendor":"Pixar Animation Studio","versions":[{"status":"affected","version":"v26.03"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30428."}],"id":"CVE-2026-92211","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92211","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T18:56:55.251051Z","version":"2.0.3"}}]},"published":"2026-11-04T00:17:31.273","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://github.com/PixarAnimationStudios/OpenUSD/commit/7c62a43d8823dd4e1ef8c49fc1d72729e1ce6e36"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-791/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-92379.json b/data/2026/CVE-2026-92379.json index 494bc0c639..7e1950221d 100644 --- a/data/2026/CVE-2026-92379.json +++ b/data/2026/CVE-2026-92379.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files."}],"id":"CVE-2026-92379","lastModified":"2026-11-12T04:17:22.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:22.230","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@synology.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"DiskStation Manager (DSM)","vendor":"Synology","versions":[{"lessThan":"7.4.1-90080-1","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThan":"7.3.2-86009-5","status":"affected","version":"7.3.2","versionType":"semver"},{"lessThan":"7.3.2","status":"unknown","version":"0","versionType":"semver"}]}],"source":"security@synology.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files."}],"id":"CVE-2026-92379","lastModified":"2026-11-12T18:50:59.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@synology.com","type":"Primary"}]},"published":"2026-11-12T04:17:22.230","references":[{"source":"security@synology.com","url":"https://www.synology.com/en-global/security/advisory/Synology_SA_26_18"}],"sourceIdentifier":"security@synology.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@synology.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-92408.json b/data/2026/CVE-2026-92408.json index 60553671e5..8117a5de79 100644 --- a/data/2026/CVE-2026-92408.json +++ b/data/2026/CVE-2026-92408.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"WPS Bookings for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"3.13.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero."}],"id":"CVE-2026-92408","lastModified":"2026-11-11T12:20:02.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92408","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:12:40.187373Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:18.920","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/c40ea3c8-2062-4b4e-a3aa-65b47291725e/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-472"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","product":"WPS Bookings for WooCommerce","vendor":"Unknown","versions":[{"lessThan":"3.13.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero."}],"id":"CVE-2026-92408","lastModified":"2026-11-12T18:49:18.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"contact@wpscan.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92408","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:12:40.187373Z","version":"2.0.3"}}]},"published":"2026-11-11T08:17:18.920","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/c40ea3c8-2062-4b4e-a3aa-65b47291725e/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-472"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-92439.json b/data/2026/CVE-2026-92439.json index 93a62745bd..5ca73934df 100644 --- a/data/2026/CVE-2026-92439.json +++ b/data/2026/CVE-2026-92439.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provider to be replayed to authenticate to Kong."}],"id":"CVE-2026-92439","lastModified":"2026-11-10T22:21:14.740","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:14.740","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provider to be replayed to authenticate to Kong."}],"id":"CVE-2026-92439","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:14.740","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-92441.json b/data/2026/CVE-2026-92441.json index 602a169980..65c99ddc7a 100644 --- a/data/2026/CVE-2026-92441.json +++ b/data/2026/CVE-2026-92441.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream."}],"id":"CVE-2026-92441","lastModified":"2026-11-10T22:21:14.867","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:14.867","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream."}],"id":"CVE-2026-92441","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:14.867","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-92442.json b/data/2026/CVE-2026-92442.json index a9fa1462f6..c6d2899d8f 100644 --- a/data/2026/CVE-2026-92442.json +++ b/data/2026/CVE-2026-92442.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another."}],"id":"CVE-2026-92442","lastModified":"2026-11-10T22:21:14.987","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:14.987","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for one caller to be served to another."}],"id":"CVE-2026-92442","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:14.987","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-92443.json b/data/2026/CVE-2026-92443.json index 2934ebfa72..1bad23d051 100644 --- a/data/2026/CVE-2026-92443.json +++ b/data/2026/CVE-2026-92443.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Proxy-Authorization to different callers."}],"id":"CVE-2026-92443","lastModified":"2026-11-10T22:21:15.133","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:15.133","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Proxy-Authorization to different callers."}],"id":"CVE-2026-92443","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:15.133","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-92544.json b/data/2026/CVE-2026-92544.json index cb8e82bb6c..eee25f834b 100644 --- a/data/2026/CVE-2026-92544.json +++ b/data/2026/CVE-2026-92544.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database via a crafted model name."}],"id":"CVE-2026-92544","lastModified":"2026-11-10T21:21:40.433","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T21:21:40.433","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database via a crafted model name."}],"id":"CVE-2026-92544","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T21:21:40.433","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-92545.json b/data/2026/CVE-2026-92545.json index 03abb6f8db..33fac3aef8 100644 --- a/data/2026/CVE-2026-92545.json +++ b/data/2026/CVE-2026-92545.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another."}],"id":"CVE-2026-92545","lastModified":"2026-11-10T22:21:15.290","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:15.290","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key which may allow a response cached for a hostname to be served for another."}],"id":"CVE-2026-92545","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:15.290","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-92558.json b/data/2026/CVE-2026-92558.json index 6f13edefdb..719d988a1c 100644 --- a/data/2026/CVE-2026-92558.json +++ b/data/2026/CVE-2026-92558.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route."}],"id":"CVE-2026-92558","lastModified":"2026-11-10T22:21:15.413","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:15.413","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route."}],"id":"CVE-2026-92558","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:15.413","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-92683.json b/data/2026/CVE-2026-92683.json index e10c42327e..6351bf34b9 100644 --- a/data/2026/CVE-2026-92683.json +++ b/data/2026/CVE-2026-92683.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://registry.npmjs.org","defaultStatus":"unaffected","packageName":"@neo4j/graphql","product":"@neo4j/graphql","repo":"https://github.com/neo4j/graphql","vendor":"Neo4j","versions":[{"lessThan":"7.6.7","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax."}],"id":"CVE-2026-92683","lastModified":"2026-11-09T10:17:15.673","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","type":"Secondary"}]},"published":"2026-11-09T10:17:15.673","references":[{"source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","url":"https://github.com/neo4j/graphql/security/advisories/GHSA-58qp-3mmm-5vh8"}],"sourceIdentifier":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://registry.npmjs.org","defaultStatus":"unaffected","packageName":"@neo4j/graphql","product":"@neo4j/graphql","repo":"https://github.com/neo4j/graphql","vendor":"Neo4j","versions":[{"lessThan":"7.6.7","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax."}],"id":"CVE-2026-92683","lastModified":"2026-11-12T17:17:47.847","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92683","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:46.562442Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:15.673","references":[{"source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","url":"https://github.com/neo4j/graphql/security/advisories/GHSA-58qp-3mmm-5vh8"}],"sourceIdentifier":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-92704.json b/data/2026/CVE-2026-92704.json index 546f80c792..72c81f0967 100644 --- a/data/2026/CVE-2026-92704.json +++ b/data/2026/CVE-2026-92704.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"sharpemu","vendor":"sharpemu","versions":[{"status":"affected","version":"< 0.0.3-release.3-patch.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765 without authentication or CSRF token. Its  do_POST  handler in  tools/SharpEmu.DebuggerFrontend/debugger_frontend.py  does not validate the Origin, Referer, Sec-Fetch-Site, or Host headers. The  _read_json_body()  function also accepts JSON sent with browser-simple content types instead of requiring  application/json . A malicious page that can reach the loopback listener can send cross-origin requests to  /api/launch ,  /api/command , and  /api/connect . Chromium may require Local Network Access permission for pages served from public origins. Local-origin pages and other delivery paths are not consistently subject to this restriction. The  /api/launch  endpoint accepts an attacker-selected  emulatorPath  if it points to an existing file on the victim’s host. On POSIX systems, that file must also be executable. The endpoint additionally requires an existing  ebootPath . The  /api/command  endpoint exposes debugger operations, including  write-memory ,  set-register , and  continue . The  /api/connect  endpoint can initiate outbound TCP connections. These operations can let an attacker execute an existing binary with the victim’s privileges, control the attached emulated process, or reach network services accessible from the host. DNS rebinding can additionally let the attacker read API responses interactively. This issue is fixed in version 0.0.3-release.3-patch.1"}],"id":"CVE-2026-92704","lastModified":"2026-11-09T17:17:34.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92704","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:31:05.128810Z","version":"2.0.3"}}]},"published":"2026-11-04T16:17:55.097","references":[{"source":"security-advisories@github.com","url":"https://github.com/sharpemu/sharpemu/commit/3831f3c407c547a5e58f353649b2c556d785c463"},{"source":"security-advisories@github.com","url":"https://github.com/sharpemu/sharpemu/pull/858"},{"source":"security-advisories@github.com","url":"https://github.com/sharpemu/sharpemu/releases/tag/v0.0.3-release.3-patch.1"},{"source":"security-advisories@github.com","url":"https://github.com/sharpemu/sharpemu/security/advisories/GHSA-fr3v-rvqp-8fx3"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/sharpemu/sharpemu/security/advisories/GHSA-fr3v-rvqp-8fx3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-350"},{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-749"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"sharpemu","vendor":"sharpemu","versions":[{"status":"affected","version":"< 0.0.3-release.3-patch.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765 without authentication or CSRF token. Its  do_POST  handler in  tools/SharpEmu.DebuggerFrontend/debugger_frontend.py  does not validate the Origin, Referer, Sec-Fetch-Site, or Host headers. The  _read_json_body()  function also accepts JSON sent with browser-simple content types instead of requiring  application/json . A malicious page that can reach the loopback listener can send cross-origin requests to  /api/launch ,  /api/command , and  /api/connect . Chromium may require Local Network Access permission for pages served from public origins. Local-origin pages and other delivery paths are not consistently subject to this restriction. The  /api/launch  endpoint accepts an attacker-selected  emulatorPath  if it points to an existing file on the victim’s host. On POSIX systems, that file must also be executable. The endpoint additionally requires an existing  ebootPath . The  /api/command  endpoint exposes debugger operations, including  write-memory ,  set-register , and  continue . The  /api/connect  endpoint can initiate outbound TCP connections. These operations can let an attacker execute an existing binary with the victim’s privileges, control the attached emulated process, or reach network services accessible from the host. DNS rebinding can additionally let the attacker read API responses interactively. This issue is fixed in version 0.0.3-release.3-patch.1"}],"id":"CVE-2026-92704","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92704","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:31:05.128810Z","version":"2.0.3"}}]},"published":"2026-11-04T16:17:55.097","references":[{"source":"security-advisories@github.com","url":"https://github.com/sharpemu/sharpemu/commit/3831f3c407c547a5e58f353649b2c556d785c463"},{"source":"security-advisories@github.com","url":"https://github.com/sharpemu/sharpemu/pull/858"},{"source":"security-advisories@github.com","url":"https://github.com/sharpemu/sharpemu/releases/tag/v0.0.3-release.3-patch.1"},{"source":"security-advisories@github.com","url":"https://github.com/sharpemu/sharpemu/security/advisories/GHSA-fr3v-rvqp-8fx3"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/sharpemu/sharpemu/security/advisories/GHSA-fr3v-rvqp-8fx3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-350"},{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-749"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-93005.json b/data/2026/CVE-2026-93005.json index 29e59a3ab6..a5566a95c3 100644 --- a/data/2026/CVE-2026-93005.json +++ b/data/2026/CVE-2026-93005.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"],"product":"Process Mining","vendor":"IBM","versions":[{"lessThanOrEqual":"2.2.1","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients."}],"id":"CVE-2026-93005","lastModified":"2026-11-08T19:17:43.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T19:17:43.177","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294875"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"],"product":"Process Mining","vendor":"IBM","versions":[{"lessThanOrEqual":"2.2.1","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients."}],"id":"CVE-2026-93005","lastModified":"2026-11-12T20:18:53.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-93005","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:03:59.271630Z","version":"2.0.3"}}]},"published":"2026-11-08T19:17:43.177","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294875"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-93487.json b/data/2026/CVE-2026-93487.json index 0042eb8f59..4c53dabe13 100644 --- a/data/2026/CVE-2026-93487.json +++ b/data/2026/CVE-2026-93487.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13487","status":"affected","version":"2019.11.0","versionType":"custom"},{"lessThan":"2026.3.15863","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform."}],"id":"CVE-2026-93487","lastModified":"2026-11-11T08:17:19.213","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-11T08:17:19.213","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-20"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@octopus.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13487","status":"affected","version":"2019.11.0","versionType":"custom"},{"lessThan":"2026.3.15863","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform."}],"id":"CVE-2026-93487","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-11T08:17:19.213","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-20"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@octopus.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-94125.json b/data/2026/CVE-2026-94125.json index 2898b72191..8dd1392651 100644 --- a/data/2026/CVE-2026-94125.json +++ b/data/2026/CVE-2026-94125.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-server","packageURL":"pkg:maven/org.apache.storm/storm-server","product":"Apache Storm","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.2.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue."}],"id":"CVE-2026-94125","lastModified":"2026-11-11T19:17:49.183","metrics":{},"published":"2026-11-11T13:17:34.763","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/8of7kv48thj82bb8vqrz6wbglmyldyvv"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/3"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.storm:storm-server","packageURL":"pkg:maven/org.apache.storm/storm-server","product":"Apache Storm","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.2.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue."}],"id":"CVE-2026-94125","lastModified":"2026-11-12T17:05:26.637","metrics":{},"published":"2026-11-11T13:17:34.763","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/8of7kv48thj82bb8vqrz6wbglmyldyvv"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/3"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-94131.json b/data/2026/CVE-2026-94131.json index 3d3d13a3ca..b60c99824c 100644 --- a/data/2026/CVE-2026-94131.json +++ b/data/2026/CVE-2026-94131.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla","vendor":"acymailing.com","versions":[{"status":"affected","version":"6.0.0-11.0.5"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"A67E95C5-E715-4DB4-8822-FEDE63FFC384","versionEndExcluding":"11.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php."}],"id":"CVE-2026-94131","lastModified":"2026-10-20T20:28:10.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-94131","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-26T22:57:46.440866Z","version":"2.0.3"}}]},"published":"2026-09-26T15:16:54.183","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@joomla.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"6.0.0-11.0.5"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"A67E95C5-E715-4DB4-8822-FEDE63FFC384","versionEndExcluding":"11.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php."}],"id":"CVE-2026-94131","lastModified":"2026-11-12T19:17:06.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-94131","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-26T22:57:46.440866Z","version":"2.0.3"}}]},"published":"2026-09-26T15:16:54.183","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-94132.json b/data/2026/CVE-2026-94132.json index be72a211e3..49cf7d9c9e 100644 --- a/data/2026/CVE-2026-94132.json +++ b/data/2026/CVE-2026-94132.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing Enterprise extension for Joomla","vendor":"acymailing.com","versions":[{"status":"affected","version":"6.0.0-11.0.5"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"A67E95C5-E715-4DB4-8822-FEDE63FFC384","versionEndExcluding":"11.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root."}],"id":"CVE-2026-94132","lastModified":"2026-10-20T20:25:58.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.5,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-94132","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-26T22:58:09.127032Z","version":"2.0.3"}}]},"published":"2026-09-26T15:16:55.397","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@joomla.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing Enterprise extension for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"6.0.0-11.0.5"}]}],"source":"security@joomla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:acymailing:acymailing:*:*:*:*:enterprise:joomla\\!:*:*","matchCriteriaId":"A67E95C5-E715-4DB4-8822-FEDE63FFC384","versionEndExcluding":"11.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root."}],"id":"CVE-2026-94132","lastModified":"2026-11-12T18:17:55.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.5,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-94132","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-26T22:58:09.127032Z","version":"2.0.3"}}]},"published":"2026-09-26T15:16:55.397","references":[{"source":"security@joomla.org","tags":["Product"],"url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-94459.json b/data/2026/CVE-2026-94459.json index d1eea73e10..75152a2462 100644 --- a/data/2026/CVE-2026-94459.json +++ b/data/2026/CVE-2026-94459.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"IRISPowerscan","vendor":"I.R.I.S S.A.","versions":[{"lessThanOrEqual":"12.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IRISPowerscan contain\ndefault user accounts with predictable credentials. An unauthenticated attacker\nwith access to an affected installation could use these credentials to\nauthenticate to the application and access functionality available to the\naffected accounts, potentially resulting in unauthorised access or modification\nof application data and configuration."}],"id":"CVE-2026-94459","lastModified":"2026-11-10T12:17:20.993","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-94459","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T11:44:59.708430Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:26.833","references":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","url":"https://www.canon-europe.com/psirt/advisory-information"}],"sourceIdentifier":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"IRISPowerscan","vendor":"I.R.I.S S.A.","versions":[{"lessThanOrEqual":"12.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IRISPowerscan contain\ndefault user accounts with predictable credentials. An unauthenticated attacker\nwith access to an affected installation could use these credentials to\nauthenticate to the application and access functionality available to the\naffected accounts, potentially resulting in unauthorised access or modification\nof application data and configuration."}],"id":"CVE-2026-94459","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-94459","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T11:44:59.708430Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:26.833","references":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","url":"https://www.canon-europe.com/psirt/advisory-information"}],"sourceIdentifier":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-94460.json b/data/2026/CVE-2026-94460.json index 1afcc0c30a..c2b65a0ee0 100644 --- a/data/2026/CVE-2026-94460.json +++ b/data/2026/CVE-2026-94460.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"IRISPowerscan","vendor":"I.R.I.S S.A.","versions":[{"lessThanOrEqual":"12.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IRISPowerscan contain an insecure default\nconfiguration where the built-in installation account is assigned elevated\nprivileges with a predictable password, which could allow an unauthenticated\nattacker to gain unauthorised access to privileged application functionality."}],"id":"CVE-2026-94460","lastModified":"2026-11-09T22:18:57.720","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-94460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:17:10.116972Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:26.987","references":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","url":"https://www.canon-europe.com/psirt/advisory-information"}],"sourceIdentifier":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"IRISPowerscan","vendor":"I.R.I.S S.A.","versions":[{"lessThanOrEqual":"12.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IRISPowerscan contain an insecure default\nconfiguration where the built-in installation account is assigned elevated\nprivileges with a predictable password, which could allow an unauthenticated\nattacker to gain unauthorised access to privileged application functionality."}],"id":"CVE-2026-94460","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-94460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:17:10.116972Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:26.987","references":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","url":"https://www.canon-europe.com/psirt/advisory-information"}],"sourceIdentifier":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-95397.json b/data/2026/CVE-2026-95397.json index 2c569df132..9c545a3dfa 100644 --- a/data/2026/CVE-2026-95397.json +++ b/data/2026/CVE-2026-95397.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-95397","lastModified":"2026-11-10T21:46:32.813","metrics":{},"published":"2026-11-10T20:19:47.730","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-95397","lastModified":"2026-11-12T20:18:54.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95397","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:12.199466Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:47.730","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-95399.json b/data/2026/CVE-2026-95399.json index ecf10a1e63..e068e79b3c 100644 --- a/data/2026/CVE-2026-95399.json +++ b/data/2026/CVE-2026-95399.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of face_status.h, there is a possible way to modify verified biometric enrollment data in shared memory due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-95399","lastModified":"2026-11-11T05:19:55.470","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:47.863","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of face_status.h, there is a possible way to modify verified biometric enrollment data in shared memory due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-95399","lastModified":"2026-11-12T20:18:54.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:58:06.693275Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:47.863","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-95400.json b/data/2026/CVE-2026-95400.json index 746626e6a8..39d497128e 100644 --- a/data/2026/CVE-2026-95400.json +++ b/data/2026/CVE-2026-95400.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-95400","lastModified":"2026-11-10T21:46:37.003","metrics":{},"published":"2026-11-10T20:19:47.997","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-95400","lastModified":"2026-11-12T19:17:06.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95400","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:08:29.675379Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:47.997","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-95401.json b/data/2026/CVE-2026-95401.json index 0fe39a2b6f..2d81bdde74 100644 --- a/data/2026/CVE-2026-95401.json +++ b/data/2026/CVE-2026-95401.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-95401","lastModified":"2026-11-10T21:46:32.843","metrics":{},"published":"2026-11-10T20:19:48.120","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-95401","lastModified":"2026-11-12T20:18:54.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95401","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:16:07.618838Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:48.120","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-95402.json b/data/2026/CVE-2026-95402.json index 50c16bb157..0806c79bc4 100644 --- a/data/2026/CVE-2026-95402.json +++ b/data/2026/CVE-2026-95402.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-95402","lastModified":"2026-11-10T21:46:40.453","metrics":{},"published":"2026-11-10T20:19:48.257","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-95402","lastModified":"2026-11-12T20:18:54.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:18:04.522398Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:48.257","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-95403.json b/data/2026/CVE-2026-95403.json index b5735502d4..5a1a52f2a5 100644 --- a/data/2026/CVE-2026-95403.json +++ b/data/2026/CVE-2026-95403.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-95403","lastModified":"2026-11-10T21:46:42.860","metrics":{},"published":"2026-11-10T20:19:48.383","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-95403","lastModified":"2026-11-12T20:18:55.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:26:42.363824Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:48.383","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-95646.json b/data/2026/CVE-2026-95646.json index f83117d1c6..891db5999a 100644 --- a/data/2026/CVE-2026-95646.json +++ b/data/2026/CVE-2026-95646.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6500","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands."}],"id":"CVE-2026-95646","lastModified":"2026-11-10T22:19:12.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-10T11:16:43.757","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6500","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands."}],"id":"CVE-2026-95646","lastModified":"2026-11-12T19:17:06.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95646","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T18:09:41.636772Z","version":"2.0.3"}}]},"published":"2026-11-10T11:16:43.757","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-95648.json b/data/2026/CVE-2026-95648.json index 64909e1018..234f8870ea 100644 --- a/data/2026/CVE-2026-95648.json +++ b/data/2026/CVE-2026-95648.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"C-Prot AppDefense","vendor":"C-Prot Inc.","versions":[{"lessThan":"1.0.2729","status":"affected","version":"0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation.\n\nThis issue affects C-Prot AppDefense: before 1.0.2729."}],"id":"CVE-2026-95648","lastModified":"2026-11-10T16:24:34.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-09T13:17:09.403","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1487"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"C-Prot AppDefense","vendor":"C-Prot Inc.","versions":[{"lessThan":"1.0.2729","status":"affected","version":"0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation.\n\nThis issue affects C-Prot AppDefense: before 1.0.2729."}],"id":"CVE-2026-95648","lastModified":"2026-11-12T17:17:47.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"iletisim@usom.gov.tr","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95648","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:07:54.410832Z","version":"2.0.3"}}]},"published":"2026-11-09T13:17:09.403","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1487"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"iletisim@usom.gov.tr","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-95649.json b/data/2026/CVE-2026-95649.json index a900a9515d..aebd452070 100644 --- a/data/2026/CVE-2026-95649.json +++ b/data/2026/CVE-2026-95649.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"IRISPowerscan","vendor":"I.R.I.S S.A.","versions":[{"lessThanOrEqual":"12.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan."}],"id":"CVE-2026-95649","lastModified":"2026-11-09T22:18:57.850","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95649","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:16:41.068820Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:27.120","references":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","url":"https://www.canon-europe.com/psirt/advisory-information"}],"sourceIdentifier":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"IRISPowerscan","vendor":"I.R.I.S S.A.","versions":[{"lessThanOrEqual":"12.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan."}],"id":"CVE-2026-95649","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95649","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:16:41.068820Z","version":"2.0.3"}}]},"published":"2026-11-04T10:17:27.120","references":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","url":"https://www.canon-europe.com/psirt/advisory-information"}],"sourceIdentifier":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96028.json b/data/2026/CVE-2026-96028.json index c4b0c7ee1c..109e9102d8 100644 --- a/data/2026/CVE-2026-96028.json +++ b/data/2026/CVE-2026-96028.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Access of resource using incompatible type ('type confusion') in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96028","lastModified":"2026-11-11T01:17:35.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96028","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:42.557048Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:59.533","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96028"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"},{"lang":"en","value":"CWE-843"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Access of resource using incompatible type ('type confusion') in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96028","lastModified":"2026-11-11T01:17:35.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96028","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:42.557048Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:59.533","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96028"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"},{"lang":"en","value":"CWE-843"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96029.json b/data/2026/CVE-2026-96029.json index 6a2af3cffe..14e18b6d92 100644 --- a/data/2026/CVE-2026-96029.json +++ b/data/2026/CVE-2026-96029.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96029","lastModified":"2026-11-11T01:17:35.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96029","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:37.152477Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:59.730","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96029"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96029","lastModified":"2026-11-11T01:17:35.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96029","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:37.152477Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:59.730","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96029"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96031.json b/data/2026/CVE-2026-96031.json index d52681885e..eb60f7a73e 100644 --- a/data/2026/CVE-2026-96031.json +++ b/data/2026/CVE-2026-96031.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96031","lastModified":"2026-11-11T01:17:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96031","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:31.856850Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:59.913","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96031"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96031","lastModified":"2026-11-11T01:17:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96031","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:31.856850Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:59.913","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96031"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96035.json b/data/2026/CVE-2026-96035.json index 1ee61119f7..799f5d4b60 100644 --- a/data/2026/CVE-2026-96035.json +++ b/data/2026/CVE-2026-96035.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96035","lastModified":"2026-11-11T01:17:36.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96035","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:26.710824Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:00.113","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96035"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96035","lastModified":"2026-11-11T01:17:36.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96035","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:26.710824Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:00.113","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96035"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96036.json b/data/2026/CVE-2026-96036.json index fa7ee88fde..0bd9752175 100644 --- a/data/2026/CVE-2026-96036.json +++ b/data/2026/CVE-2026-96036.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96036","lastModified":"2026-11-11T01:17:36.187","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:21.539405Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:00.290","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96036"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96036","lastModified":"2026-11-11T01:17:36.187","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96036","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:21.539405Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:00.290","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96036"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96037.json b/data/2026/CVE-2026-96037.json index c1e1997642..2ed46b824f 100644 --- a/data/2026/CVE-2026-96037.json +++ b/data/2026/CVE-2026-96037.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows User Manager Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96037","lastModified":"2026-11-11T01:17:36.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96037","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:16.374304Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:00.500","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96037"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows User Manager Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96037","lastModified":"2026-11-11T01:17:36.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96037","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:16.374304Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:00.500","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96037"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96038.json b/data/2026/CVE-2026-96038.json index 0facd8de36..581df6528b 100644 --- a/data/2026/CVE-2026-96038.json +++ b/data/2026/CVE-2026-96038.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Inclusion of functionality from untrusted control sphere in Windows Audio Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96038","lastModified":"2026-11-11T01:17:36.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96038","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:11.309509Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:00.697","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96038"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"},{"lang":"en","value":"CWE-829"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Inclusion of functionality from untrusted control sphere in Windows Audio Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96038","lastModified":"2026-11-11T01:17:36.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96038","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:11.309509Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:00.697","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96038"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"},{"lang":"en","value":"CWE-829"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96041.json b/data/2026/CVE-2026-96041.json index 5a94ece151..9a4cbecb56 100644 --- a/data/2026/CVE-2026-96041.json +++ b/data/2026/CVE-2026-96041.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-96041","lastModified":"2026-11-11T02:17:20.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96041","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:15:48.713052Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:00.877","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96041"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-96041","lastModified":"2026-11-11T02:17:20.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96041","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:15:48.713052Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:00.877","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96041"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96042.json b/data/2026/CVE-2026-96042.json index d9364b9ed7..8fcdf67326 100644 --- a/data/2026/CVE-2026-96042.json +++ b/data/2026/CVE-2026-96042.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96042","lastModified":"2026-11-11T01:17:36.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96042","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:06.069858Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:01.070","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96042"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96042","lastModified":"2026-11-11T01:17:36.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96042","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:06.069858Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:01.070","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96042"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96043.json b/data/2026/CVE-2026-96043.json index e7ec6cfee5..b3ed5751c5 100644 --- a/data/2026/CVE-2026-96043.json +++ b/data/2026/CVE-2026-96043.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96043","lastModified":"2026-11-11T01:17:36.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96043","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:00.864729Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:01.267","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96043"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Connection Manager Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96043","lastModified":"2026-11-11T01:17:36.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96043","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:28:00.864729Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:01.267","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96043"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96046.json b/data/2026/CVE-2026-96046.json index d4bc7b9888..8390ebead0 100644 --- a/data/2026/CVE-2026-96046.json +++ b/data/2026/CVE-2026-96046.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7807","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7807","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9711","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9711","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3231","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9711","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5761","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96046","lastModified":"2026-11-11T01:17:37.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96046","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:55.741508Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:01.517","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96046"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7807","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7807","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9711","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9711","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3231","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9711","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5761","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96046","lastModified":"2026-11-11T01:17:37.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96046","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:55.741508Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:01.517","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96046"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96047.json b/data/2026/CVE-2026-96047.json index f4330eb714..2e1d9c4f11 100644 --- a/data/2026/CVE-2026-96047.json +++ b/data/2026/CVE-2026-96047.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7807","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7807","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9711","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9711","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3231","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9711","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5761","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96047","lastModified":"2026-11-11T01:17:37.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96047","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:50.345626Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:01.740","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96047"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7807","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7807","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9711","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9711","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3231","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9711","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5761","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96047","lastModified":"2026-11-11T01:17:37.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96047","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:50.345626Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:01.740","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96047"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96048.json b/data/2026/CVE-2026-96048.json index 80501ec428..b52fd433c6 100644 --- a/data/2026/CVE-2026-96048.json +++ b/data/2026/CVE-2026-96048.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-96048","lastModified":"2026-11-11T02:17:20.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96048","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:15:47.570012Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:01.967","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96048"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-908"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-96048","lastModified":"2026-11-11T02:17:20.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96048","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:15:47.570012Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:01.967","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96048"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-908"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96051.json b/data/2026/CVE-2026-96051.json index 5fdc6c745c..0b828f1b72 100644 --- a/data/2026/CVE-2026-96051.json +++ b/data/2026/CVE-2026-96051.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96051","lastModified":"2026-11-11T01:17:37.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96051","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:44.386922Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:02.177","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96051"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96051","lastModified":"2026-11-11T01:17:37.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96051","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:44.386922Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:02.177","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96051"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96052.json b/data/2026/CVE-2026-96052.json index e35d6d0962..f7c0460a84 100644 --- a/data/2026/CVE-2026-96052.json +++ b/data/2026/CVE-2026-96052.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96052","lastModified":"2026-11-11T01:17:37.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96052","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:39.124746Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:02.370","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96052"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96052","lastModified":"2026-11-11T01:17:37.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96052","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:39.124746Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:02.370","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96052"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96053.json b/data/2026/CVE-2026-96053.json index e385a7b533..85a2ad8189 100644 --- a/data/2026/CVE-2026-96053.json +++ b/data/2026/CVE-2026-96053.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96053","lastModified":"2026-11-11T01:17:37.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96053","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:33.386448Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:02.527","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96053"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96053","lastModified":"2026-11-11T01:17:37.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96053","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:33.386448Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:02.527","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96053"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96054.json b/data/2026/CVE-2026-96054.json index e63ef526ce..fa76b13410 100644 --- a/data/2026/CVE-2026-96054.json +++ b/data/2026/CVE-2026-96054.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code locally."}],"id":"CVE-2026-96054","lastModified":"2026-11-10T22:21:16.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96054","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:16:42.898663Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:02.743","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96054"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code locally."}],"id":"CVE-2026-96054","lastModified":"2026-11-10T22:21:16.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96054","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:16:42.898663Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:02.743","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96054"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96055.json b/data/2026/CVE-2026-96055.json index 7e16ef880c..37f1b6c298 100644 --- a/data/2026/CVE-2026-96055.json +++ b/data/2026/CVE-2026-96055.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96055","lastModified":"2026-11-11T01:17:38.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96055","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:28.284974Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:02.953","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96055"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96055","lastModified":"2026-11-11T01:17:38.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96055","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:28.284974Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:02.953","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96055"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96056.json b/data/2026/CVE-2026-96056.json index 5db3770d86..a1cb8ca234 100644 --- a/data/2026/CVE-2026-96056.json +++ b/data/2026/CVE-2026-96056.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96056","lastModified":"2026-11-11T01:17:38.187","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96056","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:23.073791Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:03.153","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96056"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96056","lastModified":"2026-11-11T01:17:38.187","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96056","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:23.073791Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:03.153","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96056"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96057.json b/data/2026/CVE-2026-96057.json index 5bd0581edf..bf264ffff8 100644 --- a/data/2026/CVE-2026-96057.json +++ b/data/2026/CVE-2026-96057.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96057","lastModified":"2026-11-11T01:17:38.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96057","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:17.575831Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:03.343","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96057"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96057","lastModified":"2026-11-11T01:17:38.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96057","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:17.575831Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:03.343","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96057"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96058.json b/data/2026/CVE-2026-96058.json index 4b0024baea..46d17dc0d9 100644 --- a/data/2026/CVE-2026-96058.json +++ b/data/2026/CVE-2026-96058.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information with a physical attack."}],"id":"CVE-2026-96058","lastModified":"2026-11-11T02:17:20.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96058","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:29:47.015790Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:03.543","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96058"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information with a physical attack."}],"id":"CVE-2026-96058","lastModified":"2026-11-11T02:17:20.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96058","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:29:47.015790Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:03.543","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96058"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96059.json b/data/2026/CVE-2026-96059.json index b79d858e33..d03a079593 100644 --- a/data/2026/CVE-2026-96059.json +++ b/data/2026/CVE-2026-96059.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in HID class driver allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-96059","lastModified":"2026-11-11T02:17:20.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96059","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:15:46.452519Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:03.740","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96059"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in HID class driver allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-96059","lastModified":"2026-11-11T02:17:20.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96059","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:15:46.452519Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:03.740","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96059"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96060.json b/data/2026/CVE-2026-96060.json index fdf94e160b..e36de10e9d 100644 --- a/data/2026/CVE-2026-96060.json +++ b/data/2026/CVE-2026-96060.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96060","lastModified":"2026-11-11T01:17:38.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96060","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:12.430108Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:03.910","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96060"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96060","lastModified":"2026-11-11T01:17:38.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96060","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:12.430108Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:03.910","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96060"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96061.json b/data/2026/CVE-2026-96061.json index 7b16a3ce3f..4603178cf0 100644 --- a/data/2026/CVE-2026-96061.json +++ b/data/2026/CVE-2026-96061.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96061","lastModified":"2026-11-11T01:17:38.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96061","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:06.695297Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.093","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96061"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96061","lastModified":"2026-11-11T01:17:38.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96061","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:27:06.695297Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.093","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96061"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96062.json b/data/2026/CVE-2026-96062.json index c6c33bfc7c..7c27c10569 100644 --- a/data/2026/CVE-2026-96062.json +++ b/data/2026/CVE-2026-96062.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96062","lastModified":"2026-11-11T01:17:38.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96062","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:58.509933Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.277","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96062"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96062","lastModified":"2026-11-11T01:17:38.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96062","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:58.509933Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.277","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96062"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96064.json b/data/2026/CVE-2026-96064.json index 985cf35dd5..1cdda16271 100644 --- a/data/2026/CVE-2026-96064.json +++ b/data/2026/CVE-2026-96064.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in DNS Server allows an authorized attacker to execute code over a network."}],"id":"CVE-2026-96064","lastModified":"2026-11-10T22:21:16.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96064","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:16:32.383053Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.450","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96064"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in DNS Server allows an authorized attacker to execute code over a network."}],"id":"CVE-2026-96064","lastModified":"2026-11-10T22:21:16.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96064","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:16:32.383053Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.450","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96064"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96066.json b/data/2026/CVE-2026-96066.json index e5659f81a0..fbe7de2345 100644 --- a/data/2026/CVE-2026-96066.json +++ b/data/2026/CVE-2026-96066.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96066","lastModified":"2026-11-11T01:17:39.047","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96066","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:53.006826Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.590","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96066"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96066","lastModified":"2026-11-11T01:17:39.047","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96066","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:53.006826Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.590","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96066"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96067.json b/data/2026/CVE-2026-96067.json index b33512a9cc..183009d988 100644 --- a/data/2026/CVE-2026-96067.json +++ b/data/2026/CVE-2026-96067.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-96067","lastModified":"2026-11-11T05:19:56.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96067","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.777","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96067"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-96067","lastModified":"2026-11-11T05:19:56.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96067","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.777","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96067"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96072.json b/data/2026/CVE-2026-96072.json index faf5225906..1a574e386a 100644 --- a/data/2026/CVE-2026-96072.json +++ b/data/2026/CVE-2026-96072.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96072","lastModified":"2026-11-11T01:17:39.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:47.732850Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.973","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96072"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96072","lastModified":"2026-11-11T01:17:39.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:47.732850Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:04.973","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96072"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96073.json b/data/2026/CVE-2026-96073.json index 79e317f1ca..cc615e2993 100644 --- a/data/2026/CVE-2026-96073.json +++ b/data/2026/CVE-2026-96073.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7807","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7807","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9711","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9711","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3231","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9711","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5761","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96073","lastModified":"2026-11-11T01:17:39.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:42.439034Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:05.163","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96073"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7807","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7807","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7652","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9711","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9711","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3231","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9711","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.2.9200.26434","status":"affected","version":"6.2.9200.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2012 R2 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"6.3.9600.23470","status":"affected","version":"6.3.9600.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9612","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9376","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5761","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33650","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96073","lastModified":"2026-11-11T01:17:39.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:42.439034Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:05.163","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96073"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-822"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96074.json b/data/2026/CVE-2026-96074.json index 6f7a60a3d3..19558590c6 100644 --- a/data/2026/CVE-2026-96074.json +++ b/data/2026/CVE-2026-96074.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows AppX Package Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96074","lastModified":"2026-11-11T01:17:39.553","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:36.712328Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:05.363","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96074"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Windows AppX Package Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96074","lastModified":"2026-11-11T01:17:39.553","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:36.712328Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:05.363","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96074"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96078.json b/data/2026/CVE-2026-96078.json index 52db9be4ca..61e0e9d834 100644 --- a/data/2026/CVE-2026-96078.json +++ b/data/2026/CVE-2026-96078.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-96078","lastModified":"2026-11-11T05:19:56.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96078","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T19:22:06.210","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96078"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-191"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-96078","lastModified":"2026-11-11T05:19:56.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96078","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T19:22:06.210","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96078"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-191"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96084.json b/data/2026/CVE-2026-96084.json index b992d57327..204934c7c2 100644 --- a/data/2026/CVE-2026-96084.json +++ b/data/2026/CVE-2026-96084.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Graphic Fonts allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96084","lastModified":"2026-11-11T01:17:40.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:20.374858Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:06.890","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96084"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Graphic Fonts allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96084","lastModified":"2026-11-11T01:17:40.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:26:20.374858Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:06.890","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96084"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96092.json b/data/2026/CVE-2026-96092.json index ae090a2f7d..7aa4bc3bb0 100644 --- a/data/2026/CVE-2026-96092.json +++ b/data/2026/CVE-2026-96092.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DNS Server allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-96092","lastModified":"2026-11-10T22:21:17.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:16:10.920152Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:07.853","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96092"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DNS Server allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-96092","lastModified":"2026-11-10T22:21:17.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:16:10.920152Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:07.853","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96092"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96103.json b/data/2026/CVE-2026-96103.json index b5a80a6eb0..de81596a3b 100644 --- a/data/2026/CVE-2026-96103.json +++ b/data/2026/CVE-2026-96103.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96103","lastModified":"2026-11-11T01:17:40.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96103","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:25:53.028670Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:08.670","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96103"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96103","lastModified":"2026-11-11T01:17:40.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96103","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:25:53.028670Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:08.670","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96103"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96112.json b/data/2026/CVE-2026-96112.json index 278c64fb75..0ec1e81125 100644 --- a/data/2026/CVE-2026-96112.json +++ b/data/2026/CVE-2026-96112.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in DNS Server allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-96112","lastModified":"2026-11-11T02:17:22.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:15:41.175367Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:09.163","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96112"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in DNS Server allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-96112","lastModified":"2026-11-11T02:17:22.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:15:41.175367Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:09.163","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96112"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96158.json b/data/2026/CVE-2026-96158.json index 9c53c6c559..9516a29494 100644 --- a/data/2026/CVE-2026-96158.json +++ b/data/2026/CVE-2026-96158.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96158","lastModified":"2026-11-11T01:17:42.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96158","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:24:47.917581Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:13.210","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96158"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-908"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96158","lastModified":"2026-11-11T01:17:42.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96158","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:24:47.917581Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:13.210","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96158"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-908"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96172.json b/data/2026/CVE-2026-96172.json index 6fc98d0f14..bbb3f42895 100644 --- a/data/2026/CVE-2026-96172.json +++ b/data/2026/CVE-2026-96172.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"No cwe for this issue in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96172","lastModified":"2026-11-11T01:17:43.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96172","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:24:21.938858Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:17.283","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96172"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"No cwe for this issue in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96172","lastModified":"2026-11-11T01:17:43.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96172","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:24:21.938858Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:17.283","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96172"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96174.json b/data/2026/CVE-2026-96174.json index fbcea88d17..2a9a34dd3d 100644 --- a/data/2026/CVE-2026-96174.json +++ b/data/2026/CVE-2026-96174.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96174","lastModified":"2026-11-11T01:17:43.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:24:16.565609Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:17.467","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96174"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96174","lastModified":"2026-11-11T01:17:43.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:24:16.565609Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:17.467","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96174"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96175.json b/data/2026/CVE-2026-96175.json index 2c744bd580..f87af085ae 100644 --- a/data/2026/CVE-2026-96175.json +++ b/data/2026/CVE-2026-96175.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96175","lastModified":"2026-11-11T01:17:43.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:24:11.371207Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:17.627","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96175"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96175","lastModified":"2026-11-11T01:17:43.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:24:11.371207Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:17.627","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96175"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96177.json b/data/2026/CVE-2026-96177.json index a44193280b..07d1a7065f 100644 --- a/data/2026/CVE-2026-96177.json +++ b/data/2026/CVE-2026-96177.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DNS Server allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-96177","lastModified":"2026-11-10T22:21:17.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:15:49.801595Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:17.970","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96177"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DNS Server allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-96177","lastModified":"2026-11-10T22:21:17.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:15:49.801595Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:17.970","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96177"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96179.json b/data/2026/CVE-2026-96179.json index f396d67210..beb9980eec 100644 --- a/data/2026/CVE-2026-96179.json +++ b/data/2026/CVE-2026-96179.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DNS Server allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96179","lastModified":"2026-11-11T01:17:44.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:24:05.954836Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:18.120","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96179"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DNS Server allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96179","lastModified":"2026-11-11T01:17:44.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:24:05.954836Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:18.120","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96179"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96285.json b/data/2026/CVE-2026-96285.json index 43762347be..374de09751 100644 --- a/data/2026/CVE-2026-96285.json +++ b/data/2026/CVE-2026-96285.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"3.3.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later."}],"id":"CVE-2026-96285","lastModified":"2026-11-10T21:12:58.140","metrics":{},"published":"2026-11-09T10:17:16.203","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73576"},{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73577"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/5grvgsjw0c47q0pko8vnfy35drj4jyck"},{"source":"security@apache.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-67260"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"3.3.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes permitted by the deserialization allow-list — which by default includes Airflow's own classes — and runs their constructors inside the scheduler process before the check can reject the value. A Dag author, who controls a task's `next_kwargs` through the task execution API, can therefore still trigger constructor execution in the scheduler when the `awaiting_input` timeout sweep processes the task, and in the API server when the task instance is served to a worker using an older Execution API version; no non-default configuration is required. Versions before 3.3.0 are not affected. This is an incomplete fix for CVE-2026-67260: deployments that upgraded to 3.3.1 for that issue must also upgrade to apache-airflow 3.4.0 or later."}],"id":"CVE-2026-96285","lastModified":"2026-11-12T17:17:48.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96285","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:19:19.371977Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:16.203","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73576"},{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/73577"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/5grvgsjw0c47q0pko8vnfy35drj4jyck"},{"source":"security@apache.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-67260"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96414.json b/data/2026/CVE-2026-96414.json index 734875786f..793b562384 100644 --- a/data/2026/CVE-2026-96414.json +++ b/data/2026/CVE-2026-96414.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13487","status":"affected","version":"2022.1.3143","versionType":"custom"},{"lessThan":"2026.3.15875","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator."}],"id":"CVE-2026-96414","lastModified":"2026-11-11T08:17:19.357","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-11T07:17:36.980","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-19"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-649"}],"source":"security@octopus.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","Linux"],"product":"Octopus Server","vendor":"Octopus Deploy","versions":[{"lessThan":"2026.2.13487","status":"affected","version":"2022.1.3143","versionType":"custom"},{"lessThan":"2026.3.15875","status":"affected","version":"2026.3.0","versionType":"custom"}]}],"source":"security@octopus.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator."}],"id":"CVE-2026-96414","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@octopus.com","type":"Secondary"}]},"published":"2026-11-11T07:17:36.980","references":[{"source":"security@octopus.com","url":"https://advisories.octopus.com/post/2026/sa2026-19"}],"sourceIdentifier":"security@octopus.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-649"}],"source":"security@octopus.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96437.json b/data/2026/CVE-2026-96437.json index 71c8e188de..447ed79d4a 100644 --- a/data/2026/CVE-2026-96437.json +++ b/data/2026/CVE-2026-96437.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.11","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.4","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.1","status":"affected","version":"3.16.0.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks."}],"id":"CVE-2026-96437","lastModified":"2026-11-10T22:21:17.753","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:17.753","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-636"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.11","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.4","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.1","status":"affected","version":"3.16.0.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks."}],"id":"CVE-2026-96437","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:17.753","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-636"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96974.json b/data/2026/CVE-2026-96974.json index d08b6dff51..5b2e6091db 100644 --- a/data/2026/CVE-2026-96974.json +++ b/data/2026/CVE-2026-96974.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack."}],"id":"CVE-2026-96974","lastModified":"2026-11-11T01:17:45.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96974","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:12:26.665552Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:19.857","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96974"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack."}],"id":"CVE-2026-96974","lastModified":"2026-11-11T01:17:45.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96974","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:12:26.665552Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:19.857","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96974"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96975.json b/data/2026/CVE-2026-96975.json index 822e43f29a..b7dcc3c1ff 100644 --- a/data/2026/CVE-2026-96975.json +++ b/data/2026/CVE-2026-96975.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network."}],"id":"CVE-2026-96975","lastModified":"2026-11-11T02:17:24.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96975","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:33:19.998311Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:20.070","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96975"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network."}],"id":"CVE-2026-96975","lastModified":"2026-11-11T02:17:24.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96975","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:33:19.998311Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:20.070","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96975"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96979.json b/data/2026/CVE-2026-96979.json index 8f75938d22..af5a8cde57 100644 --- a/data/2026/CVE-2026-96979.json +++ b/data/2026/CVE-2026-96979.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack."}],"id":"CVE-2026-96979","lastModified":"2026-11-11T01:17:45.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96979","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:12:21.250220Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:20.550","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96979"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack."}],"id":"CVE-2026-96979","lastModified":"2026-11-11T01:17:45.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96979","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:12:21.250220Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:20.550","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96979"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96982.json b/data/2026/CVE-2026-96982.json index 68237bb85e..0c21051f0f 100644 --- a/data/2026/CVE-2026-96982.json +++ b/data/2026/CVE-2026-96982.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack."}],"id":"CVE-2026-96982","lastModified":"2026-11-11T01:17:45.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96982","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:12:10.969921Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:21.073","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96982"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack."}],"id":"CVE-2026-96982","lastModified":"2026-11-11T01:17:45.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96982","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:12:10.969921Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:21.073","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96982"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96989.json b/data/2026/CVE-2026-96989.json index 47a2919c7e..070c707fbf 100644 --- a/data/2026/CVE-2026-96989.json +++ b/data/2026/CVE-2026-96989.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-96989","lastModified":"2026-11-11T02:17:25.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96989","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:15:32.872845Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:22.250","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96989"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-96989","lastModified":"2026-11-11T02:17:25.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96989","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T01:15:32.872845Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:22.250","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96989"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-96994.json b/data/2026/CVE-2026-96994.json index 6e03ec622f..4a76547888 100644 --- a/data/2026/CVE-2026-96994.json +++ b/data/2026/CVE-2026-96994.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Winsock allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96994","lastModified":"2026-11-11T01:17:46.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96994","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:23:28.772738Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:22.810","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96994"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Winsock allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-96994","lastModified":"2026-11-11T01:17:46.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96994","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T00:23:28.772738Z","version":"2.0.3"}}]},"published":"2026-11-10T19:22:22.810","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96994"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-97373.json b/data/2026/CVE-2026-97373.json index f3bdf57684..42e91446d2 100644 --- a/data/2026/CVE-2026-97373.json +++ b/data/2026/CVE-2026-97373.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"drawio","vendor":"jgraph","versions":[{"status":"affected","version":"< 30.3.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8."}],"id":"CVE-2026-97373","lastModified":"2026-11-09T17:17:35.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-97373","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:33:53.413943Z","version":"2.0.3"}}]},"published":"2026-11-04T21:18:17.063","references":[{"source":"security-advisories@github.com","url":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d"},{"source":"security-advisories@github.com","url":"https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"drawio","vendor":"jgraph","versions":[{"status":"affected","version":"< 30.3.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8."}],"id":"CVE-2026-97373","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-97373","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:33:53.413943Z","version":"2.0.3"}}]},"published":"2026-11-04T21:18:17.063","references":[{"source":"security-advisories@github.com","url":"https://github.com/jgraph/drawio/commit/73c4a91196246bbdb60f52b15871e82006b7972d"},{"source":"security-advisories@github.com","url":"https://github.com/jgraph/drawio/security/advisories/GHSA-xc39-mcq4-fr4q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-97401.json b/data/2026/CVE-2026-97401.json index 624c7e4c28..76f76c851e 100644 --- a/data/2026/CVE-2026-97401.json +++ b/data/2026/CVE-2026-97401.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"0.7.0","versionType":"custom"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable \"Unprivileged\" executor drops to the `kura` user via `su`.\n\n\n\nA caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected.\n\n\n\nThe command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.\n\n\n\n[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94"}],"id":"CVE-2026-97401","lastModified":"2026-11-10T17:17:55.450","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T17:17:55.450","references":[{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/323"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/922"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-269"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"0.7.0","versionType":"custom"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the command to the executor service. On a packaged Kura installation the JVM runs as `kurad` with `CAP_DAC_OVERRIDE`, while the configurable \"Unprivileged\" executor drops to the `kura` user via `su`.\n\n\n\nA caller with permissions `rest.command` who is intentionally restricted to unprivileged command execution (`privileged.command.service.enable=false`, the default) can therefore set `workingDirectory` to `/` and use the ZIP body to write or overwrite arbitrary files on the device as `kurad`, completely bypassing the unprivileged sandbox the operator selected.\n\n\n\nThe command service is disabled by default since Kura 4.0.0 [1]. The issue does not apply when the command service is disabled.\n\n\n\n[1] https://github.com/eclipse-kura/kura/blob/f9f969231892769a269876b23f19fa0e8173e3df/kura/distrib/RELEASE_NOTES.txt#L94"}],"id":"CVE-2026-97401","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T17:17:55.450","references":[{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/323"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/922"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-269"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97402.json b/data/2026/CVE-2026-97402.json index 2c5c0ada86..d01b13aa0c 100644 --- a/data/2026/CVE-2026-97402.json +++ b/data/2026/CVE-2026-97402.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"3.1.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura beacon-scanner thread into a tight infinite loop, pinning a CPU core and permanently halting beacon ingestion until the gateway is restarted. To trigger the attack, the iBeacon/Eddystone scanner component should be installed and active. By default the components are not installed or enabled."}],"id":"CVE-2026-97402","lastModified":"2026-11-10T16:17:25.050","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T16:17:25.050","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-x83q-g5h7-ffc5"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/322"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/923"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-194"},{"lang":"en","value":"CWE-835"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"3.1.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura beacon-scanner thread into a tight infinite loop, pinning a CPU core and permanently halting beacon ingestion until the gateway is restarted. To trigger the attack, the iBeacon/Eddystone scanner component should be installed and active. By default the components are not installed or enabled."}],"id":"CVE-2026-97402","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T16:17:25.050","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-x83q-g5h7-ffc5"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/322"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/923"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-194"},{"lang":"en","value":"CWE-835"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97693.json b/data/2026/CVE-2026-97693.json index 67c27394df..06576367e6 100644 --- a/data/2026/CVE-2026-97693.json +++ b/data/2026/CVE-2026-97693.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Yuxi","vendor":"xerrors","versions":[{"status":"affected","version":">= 0.6.0.beta1, < 0.7.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute commands in their own sandbox can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials. Sandboxes can also reach shared internal services; if shipped default service credentials remain unchanged, an attacker can use them, and if the exposed PostgreSQL account is a superuser, obtain command execution in the PostgreSQL container. These paths can disclose or modify cross-tenant data and sandbox state or cause denial of service through sandbox deletion without a container escape or kernel vulnerability. This vulnerability is fixed in 0.7.1. Existing deployments must separately rotate persisted PostgreSQL, Neo4j, or MinIO credentials that were previously set to documented or shipped defaults because upgrading the Compose files does not automatically rotate them."}],"id":"CVE-2026-97693","lastModified":"2026-11-09T17:17:35.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-97693","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:11:47.962800Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:07.687","references":[{"source":"security-advisories@github.com","url":"https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663"},{"source":"security-advisories@github.com","url":"https://github.com/xerrors/Yuxi/security/advisories/GHSA-qpm5-6332-9445"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-522"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Yuxi","vendor":"xerrors","versions":[{"status":"affected","version":">= 0.6.0.beta1, < 0.7.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute commands in their own sandbox can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials. Sandboxes can also reach shared internal services; if shipped default service credentials remain unchanged, an attacker can use them, and if the exposed PostgreSQL account is a superuser, obtain command execution in the PostgreSQL container. These paths can disclose or modify cross-tenant data and sandbox state or cause denial of service through sandbox deletion without a container escape or kernel vulnerability. This vulnerability is fixed in 0.7.1. Existing deployments must separately rotate persisted PostgreSQL, Neo4j, or MinIO credentials that were previously set to documented or shipped defaults because upgrading the Compose files does not automatically rotate them."}],"id":"CVE-2026-97693","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-97693","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:11:47.962800Z","version":"2.0.3"}}]},"published":"2026-11-04T22:18:07.687","references":[{"source":"security-advisories@github.com","url":"https://github.com/xerrors/Yuxi/commit/b5b5713e6e639dd4ed2ebce41579a3c458347663"},{"source":"security-advisories@github.com","url":"https://github.com/xerrors/Yuxi/security/advisories/GHSA-qpm5-6332-9445"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-522"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-97849.json b/data/2026/CVE-2026-97849.json index 8131d316d4..9d26662870 100644 --- a/data/2026/CVE-2026-97849.json +++ b/data/2026/CVE-2026-97849.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-derbynet","packageURL":"pkg:maven/org.apache.openejb/openejb-derbynet","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-derbynet","packageURL":"pkg:maven/org.apache.tomee/openejb-derbynet","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-97849","lastModified":"2026-11-10T16:17:25.200","metrics":{},"published":"2026-11-10T16:17:25.200","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/20fl5wnn3slxs0tq0ktmrc9xv9glffhq"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1327"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-derbynet","packageURL":"pkg:maven/org.apache.openejb/openejb-derbynet","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-derbynet","packageURL":"pkg:maven/org.apache.tomee/openejb-derbynet","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-97849","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:25.200","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/20fl5wnn3slxs0tq0ktmrc9xv9glffhq"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1327"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97867.json b/data/2026/CVE-2026-97867.json index cfab892028..7003d2c050 100644 --- a/data/2026/CVE-2026-97867.json +++ b/data/2026/CVE-2026-97867.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-ejbd","packageURL":"pkg:maven/org.apache.openejb/openejb-ejbd","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-ejbd","packageURL":"pkg:maven/org.apache.tomee/openejb-ejbd","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-97867","lastModified":"2026-11-10T16:17:25.340","metrics":{},"published":"2026-11-10T16:17:25.340","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/f6nqckc3wgqnnsrkb1hd640o3k4omfvr"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-ejbd","packageURL":"pkg:maven/org.apache.openejb/openejb-ejbd","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-ejbd","packageURL":"pkg:maven/org.apache.tomee/openejb-ejbd","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"id":"CVE-2026-97867","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:25.340","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/f6nqckc3wgqnnsrkb1hd640o3k4omfvr"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97870.json b/data/2026/CVE-2026-97870.json index b137fad975..de1264ca25 100644 --- a/data/2026/CVE-2026-97870.json +++ b/data/2026/CVE-2026-97870.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-hessian","packageURL":"pkg:maven/org.apache.openejb/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.6.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-hessian","packageURL":"pkg:maven/org.apache.tomee/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."}],"id":"CVE-2026-97870","lastModified":"2026-11-10T16:17:26.180","metrics":{},"published":"2026-11-10T16:17:26.180","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/hvggn9r4nod9yrww9qrz5vttcrcvomhz"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-hessian","packageURL":"pkg:maven/org.apache.openejb/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.6.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-hessian","packageURL":"pkg:maven/org.apache.tomee/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments that use the embedded HTTP server rather than Tomcat and rely on these settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."}],"id":"CVE-2026-97870","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:26.180","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/hvggn9r4nod9yrww9qrz5vttcrcvomhz"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97872.json b/data/2026/CVE-2026-97872.json index cee420034d..c799defdd8 100644 --- a/data/2026/CVE-2026-97872.json +++ b/data/2026/CVE-2026-97872.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-hessian","packageURL":"pkg:maven/org.apache.openejb/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.6.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-hessian","packageURL":"pkg:maven/org.apache.tomee/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module with such settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."}],"id":"CVE-2026-97872","lastModified":"2026-11-10T16:17:26.413","metrics":{},"published":"2026-11-10T16:17:26.413","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/hythwhxfnmghgv21y2pw73s41qt99z72"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-hessian","packageURL":"pkg:maven/org.apache.openejb/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.6.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-hessian","packageURL":"pkg:maven/org.apache.tomee/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module with such settings are affected. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."}],"id":"CVE-2026-97872","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:26.413","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/hythwhxfnmghgv21y2pw73s41qt99z72"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97874.json b/data/2026/CVE-2026-97874.json index aabf5075e8..2915f7039f 100644 --- a/data/2026/CVE-2026-97874.json +++ b/data/2026/CVE-2026-97874.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-hessian","packageURL":"pkg:maven/org.apache.openejb/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.6.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-hessian","packageURL":"pkg:maven/org.apache.tomee/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."}],"id":"CVE-2026-97874","lastModified":"2026-11-10T16:17:26.560","metrics":{},"published":"2026-11-10T16:17:26.560","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/jl8dn3bdz52n8126gvc85nddprkwjhmq"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-hessian","packageURL":"pkg:maven/org.apache.openejb/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.6.0","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-hessian","packageURL":"pkg:maven/org.apache.tomee/openejb-hessian","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to block network access to Hessian endpoints from untrusted clients, or to migrate to another remoting protocol."}],"id":"CVE-2026-97874","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:26.560","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/jl8dn3bdz52n8126gvc85nddprkwjhmq"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97880.json b/data/2026/CVE-2026-97880.json index 6ef87043f9..924e1d7fd9 100644 --- a/data/2026/CVE-2026-97880.json +++ b/data/2026/CVE-2026-97880.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-http","packageURL":"pkg:maven/org.apache.openejb/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with Basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-97880","lastModified":"2026-11-10T16:17:26.710","metrics":{},"published":"2026-11-10T16:17:26.710","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-http","packageURL":"pkg:maven/org.apache.openejb/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with Basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-97880","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:26.710","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/fm51rhyqmjv2b9hphro608thj4yr4ngx"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97881.json b/data/2026/CVE-2026-97881.json index d882fd098b..35bdb6454c 100644 --- a/data/2026/CVE-2026-97881.json +++ b/data/2026/CVE-2026-97881.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-97881","lastModified":"2026-11-10T16:17:26.870","metrics":{},"published":"2026-11-10T16:17:26.870","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/pptsyzp963c01nmss9hn7p68pthzdnp9"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-97881","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:26.870","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/pptsyzp963c01nmss9hn7p68pthzdnp9"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97888.json b/data/2026/CVE-2026-97888.json index 5d003fc77d..51d67391fa 100644 --- a/data/2026/CVE-2026-97888.json +++ b/data/2026/CVE-2026-97888.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user's privileges. Only applications served by the embedded HTTP server that authenticate programmatically or via basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-97888","lastModified":"2026-11-10T16:17:27.037","metrics":{},"published":"2026-11-10T16:17:27.037","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/7snc0d5bd2hvk1416v5b34pjgn0mmdvn"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-488"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that user's privileges. Only applications served by the embedded HTTP server that authenticate programmatically or via basic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-97888","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:27.037","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/7snc0d5bd2hvk1416v5b34pjgn0mmdvn"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-488"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97890.json b/data/2026/CVE-2026-97890.json index 70b1a34572..7262ab0054 100644 --- a/data/2026/CVE-2026-97890.json +++ b/data/2026/CVE-2026-97890.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-97890","lastModified":"2026-11-10T16:17:27.153","metrics":{},"published":"2026-11-10T16:17:27.153","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/2wx7lvso54j2xp6m7omq12hkcb9tfzjx"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-384"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-http","packageURL":"pkg:maven/org.apache.tomee/openejb-http","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.2.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions."}],"id":"CVE-2026-97890","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-10T16:17:27.153","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/2wx7lvso54j2xp6m7omq12hkcb9tfzjx"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-384"}],"source":"security@apache.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-97891.json b/data/2026/CVE-2026-97891.json index 9b8976bd63..b9ca6f5d87 100644 --- a/data/2026/CVE-2026-97891.json +++ b/data/2026/CVE-2026-97891.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"5.0.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura version 5.0.0 to 5.6.2, the Web Console allocates a new HTTP session for every request to its built-in authentication endpoints (/admin/auth, /admin/login/password, /admin/login/cert) before checking the HTTP method, parsing the request, or validating any submitted credentials, and does not limit how many such sessions can be allocated. An unauthenticated client that sends requests to these endpoints without honoring the returned session cookie can cause the server to allocate an unbounded number of sessions, exhausting the JVM heap and crashing the Kura process."}],"id":"CVE-2026-97891","lastModified":"2026-11-10T17:17:57.597","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T17:17:57.597","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-4pwp-99h8-c44j"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/325"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"emo@eclipse.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Kura","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"5.6.2","status":"affected","version":"5.0.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Kura version 5.0.0 to 5.6.2, the Web Console allocates a new HTTP session for every request to its built-in authentication endpoints (/admin/auth, /admin/login/password, /admin/login/cert) before checking the HTTP method, parsing the request, or validating any submitted credentials, and does not limit how many such sessions can be allocated. An unauthenticated client that sends requests to these endpoints without honoring the returned session cookie can cause the server to allocate an unbounded number of sessions, exhausting the JVM heap and crashing the Kura process."}],"id":"CVE-2026-97891","lastModified":"2026-11-12T18:44:06.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-10T17:17:57.597","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-4pwp-99h8-c44j"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/325"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"emo@eclipse.org","type":"Primary"}]} diff --git a/data/2026/CVE-2026-98089.json b/data/2026/CVE-2026-98089.json index b3a42f55ac..cd15c9591f 100644 --- a/data/2026/CVE-2026-98089.json +++ b/data/2026/CVE-2026-98089.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/bonding/bond_alb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"862c8eb6947689c44fe11353755576a3672563a5","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"},{"lessThan":"7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"},{"lessThan":"e39cf90bd856443542b97933289749fca07476bf","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"},{"lessThan":"27314f96d29b54e815e7a9b84c3273f1895e68e2","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"},{"lessThan":"3b178894931a268c09126a5b53630f343e10e296","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"},{"lessThan":"70f3995830d3f1e79faa14eb0605914f778feca9","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/bonding/bond_alb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: fix uninitialized transport header access in alb_determine_nd()\n\nalb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.\nHowever, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets\nor forwarded packets), skb->transport_header is not guaranteed to be\ninitialized. While pskb_network_may_pull() ensures the packet data is\nlinear starting from the network header, it does not set or adjust the\ntransport header offset.\n\nDereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.\n\nFetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),\nand reload ipv6hdr in case pskb_may_pull() reallocated skb->head.\nAlso remove the unused bond argument from alb_determine_nd()."}],"id":"CVE-2026-98089","lastModified":"2026-10-19T10:18:05.423","metrics":{},"published":"2026-09-25T11:17:38.590","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/27314f96d29b54e815e7a9b84c3273f1895e68e2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3b178894931a268c09126a5b53630f343e10e296"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/70f3995830d3f1e79faa14eb0605914f778feca9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/862c8eb6947689c44fe11353755576a3672563a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e39cf90bd856443542b97933289749fca07476bf"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/bonding/bond_alb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"862c8eb6947689c44fe11353755576a3672563a5","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"},{"lessThan":"7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"},{"lessThan":"e39cf90bd856443542b97933289749fca07476bf","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"},{"lessThan":"27314f96d29b54e815e7a9b84c3273f1895e68e2","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"},{"lessThan":"3b178894931a268c09126a5b53630f343e10e296","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"},{"lessThan":"70f3995830d3f1e79faa14eb0605914f778feca9","status":"affected","version":"0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/bonding/bond_alb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BB255577-6993-4763-B895-A85B935A0D68","versionEndExcluding":"6.1.189","versionStartIncluding":"5.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0","versionEndExcluding":"6.6.158","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81","versionEndExcluding":"6.12.111","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8","versionEndExcluding":"6.18.53","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921","versionEndExcluding":"7.2.7","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: fix uninitialized transport header access in alb_determine_nd()\n\nalb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.\nHowever, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets\nor forwarded packets), skb->transport_header is not guaranteed to be\ninitialized. While pskb_network_may_pull() ensures the packet data is\nlinear starting from the network header, it does not set or adjust the\ntransport header offset.\n\nDereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.\n\nFetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),\nand reload ipv6hdr in case pskb_may_pull() reallocated skb->head.\nAlso remove the unused bond argument from alb_determine_nd()."}],"id":"CVE-2026-98089","lastModified":"2026-11-12T18:31:05.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-09-25T11:17:38.590","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/27314f96d29b54e815e7a9b84c3273f1895e68e2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b178894931a268c09126a5b53630f343e10e296"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70f3995830d3f1e79faa14eb0605914f778feca9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7adb1bf25b0c5cedfb49b6e82844394d4f3c0d99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/862c8eb6947689c44fe11353755576a3672563a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e39cf90bd856443542b97933289749fca07476bf"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-98106.json b/data/2026/CVE-2026-98106.json index 86cdceed70..bf48fe593a 100644 --- a/data/2026/CVE-2026-98106.json +++ b/data/2026/CVE-2026-98106.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/drm_pagemap.c","include/drm/drm_pagemap.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"62451f540c46bf5c51143a1c8681b472608bd54d","status":"affected","version":"99624bdff8670795b678eafa6509aaad3a5c0175","versionType":"git"},{"lessThan":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","status":"affected","version":"99624bdff8670795b678eafa6509aaad3a5c0175","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/drm_pagemap.c","include/drm/drm_pagemap.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/pagemap: Prevent double migration of device pages\n\nA device-private folio migrated to system memory by a CPU fault can\nremain reachable through the raw-PFN eviction path until migration\nfinalization drops the source reference.\n\nIf eviction selects the same device-private folio during this window,\nit can attempt to migrate the folio again. The second migration can leave\nan uncharged folio on an LRU list, causing folio_lruvec_lock_irqsave() to\nretry indefinitely and resulting in a soft lockup and RCU stall.\n\nMark successfully migrated device-private folios using a low bit of\ntheir zone_device_data before migration finalization. Make both CPU-fault\nand raw-PFN migration paths skip device-private folios carrying this\nflag.\n\nMask the flag when retrieving the drm_pagemap_zdd pointer and preserve\nit when a device-private folio is split. Keeping the state on the physical\nfolio also avoids depending on a virtual address that may change before a\nfault occurs.\n\nv2:\n- Replace the retired-PFN XArray with an embedded bitmap. (Matthew Brost)\n- Mark every base page covered by a migrated folio so retirement remains\n valid if the folio is later split.\n\nv3:\n- Store the migrated state in a low bit of zone_device_data instead of\n adding virtual-range and bitmap tracking to the ZDD. (Matthew Brost)\n- Mask the flag when retrieving the ZDD and preserve it when splitting\n a folio.\n- Drop the pre-existing fixes already covered by Matthew Brost's series:\n https://patchwork.freedesktop.org/series/171651/\n\nv4:\n- Advance by the folio size only for migration entries marked with\n MIGRATE_PFN_COMPOUND. (Sashiko)\n\nv5:\n- Simplify ZDD flag updates and folio iteration. (Matthew Brost)\n- Skip retired device-private folios in the CPU-fault path. (Matthew Brost)\n- Preserve flag bits while taking a new ZDD reference for split folios.\n\nv6:\n- Restore MIGRATE_PFN_COMPOUND-aware stepping so non-compound migration\n entries are processed one at a time. (Sashiko)\n- Drop the pre-existing fixes already covered by Matthew Brost's series:\n https://patchwork.freedesktop.org/series/171651/\n\nThe lockup was observed as:\n[10109.860465] watchdog: BUG: soft lockup - CPU#9 stuck for 26s! [kworker/u65:5:6557]\n[10109.860524] Tainted: [S]=CPU_OUT_OF_SPEC, [O]=OOT_MODULE\n[10109.860524] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023\n[10109.860525] Workqueue: xe_page_fault_work_queue xe_pagefault_queue_work [xe]\n[10109.860644] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80\n[10109.860655] Call Trace:\n[10109.860655] \n[10109.860657] folio_lruvec_lock_irqsave+0x216/0x220\n[10109.860661] ? __pfx_lru_add+0x10/0x10\n[10109.860665] folio_batch_move_lru+0xc8/0x450\n[10109.860670] ? lock_acquire+0xc4/0x2d0\n[10109.860674] ? __folio_batch_add_and_move+0x60/0x2e0\n[10109.860677] ? folio_migrate_mapping+0xa6/0x110\n[10109.860679] ? folio_migrate_flags+0x13b/0x1b0\n[10109.860681] ? __pfx_lru_add+0x10/0x10\n[10109.860683] __folio_batch_add_and_move+0xe7/0x2e0\n[10109.860685] ? dma_iova_try_alloc+0xb0/0x140\n[10109.860689] folio_add_lru+0x64/0x80\n[10109.860691] __migrate_device_finalize+0x12c/0x270\n[10109.860695] migrate_device_finalize+0x10/0x20\n[10109.860698] drm_pagemap_evict_to_ram+0x185/0x370 [drm_gpusvm_helper]\n[10109.860704] ? drm_pagemap_evict_to_ram+0x96/0x370 [drm_gpusvm_helper]\n[10109.860709] xe_svm_bo_evict+0x15/0x20 [xe]\n[10109.860819] ? xe_svm_bo_evict+0x15/0x20 [xe]\n[10109.860921] xe_bo_move+0x107e/0x1570 [xe]\n[10109.860992] ? xe_ttm_tt_create+0x168/0x340 [xe]\n[10109.861059] ? __up_read+0x98/0x2b0\n[10109.861061] ? lock_is_held_type+0xa3/0x130\n[10109.861067] ttm_bo_handle_move_mem+0xe8/0x1e0 [ttm]\n[10109.861075] ttm_bo_evict+0x141/0x1c0 [ttm]\n[10109.861081] ttm_bo_evict_cb+0x9f/0x100 [ttm]\n[10109.861086] ttm_lru_walk_for_evict+0x84/0x190 [ttm]\n[10109.861091] ? xe_ttm_vram_mgr_new+0x258/0x3a0 [xe]\n[10109.861198] ttm_bo_alloc_resource+0x219/0\n---truncated---"}],"id":"CVE-2026-98106","lastModified":"2026-10-19T10:18:08.090","metrics":{},"published":"2026-09-25T11:17:41.110","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/62451f540c46bf5c51143a1c8681b472608bd54d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/drm_pagemap.c","include/drm/drm_pagemap.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"62451f540c46bf5c51143a1c8681b472608bd54d","status":"affected","version":"99624bdff8670795b678eafa6509aaad3a5c0175","versionType":"git"},{"lessThan":"c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c","status":"affected","version":"99624bdff8670795b678eafa6509aaad3a5c0175","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/drm_pagemap.c","include/drm/drm_pagemap.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F28B31C4-A488-40A3-9088-EED46D8DE183","versionEndExcluding":"7.2.7","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/pagemap: Prevent double migration of device pages\n\nA device-private folio migrated to system memory by a CPU fault can\nremain reachable through the raw-PFN eviction path until migration\nfinalization drops the source reference.\n\nIf eviction selects the same device-private folio during this window,\nit can attempt to migrate the folio again. The second migration can leave\nan uncharged folio on an LRU list, causing folio_lruvec_lock_irqsave() to\nretry indefinitely and resulting in a soft lockup and RCU stall.\n\nMark successfully migrated device-private folios using a low bit of\ntheir zone_device_data before migration finalization. Make both CPU-fault\nand raw-PFN migration paths skip device-private folios carrying this\nflag.\n\nMask the flag when retrieving the drm_pagemap_zdd pointer and preserve\nit when a device-private folio is split. Keeping the state on the physical\nfolio also avoids depending on a virtual address that may change before a\nfault occurs.\n\nv2:\n- Replace the retired-PFN XArray with an embedded bitmap. (Matthew Brost)\n- Mark every base page covered by a migrated folio so retirement remains\n valid if the folio is later split.\n\nv3:\n- Store the migrated state in a low bit of zone_device_data instead of\n adding virtual-range and bitmap tracking to the ZDD. (Matthew Brost)\n- Mask the flag when retrieving the ZDD and preserve it when splitting\n a folio.\n- Drop the pre-existing fixes already covered by Matthew Brost's series:\n https://patchwork.freedesktop.org/series/171651/\n\nv4:\n- Advance by the folio size only for migration entries marked with\n MIGRATE_PFN_COMPOUND. (Sashiko)\n\nv5:\n- Simplify ZDD flag updates and folio iteration. (Matthew Brost)\n- Skip retired device-private folios in the CPU-fault path. (Matthew Brost)\n- Preserve flag bits while taking a new ZDD reference for split folios.\n\nv6:\n- Restore MIGRATE_PFN_COMPOUND-aware stepping so non-compound migration\n entries are processed one at a time. (Sashiko)\n- Drop the pre-existing fixes already covered by Matthew Brost's series:\n https://patchwork.freedesktop.org/series/171651/\n\nThe lockup was observed as:\n[10109.860465] watchdog: BUG: soft lockup - CPU#9 stuck for 26s! [kworker/u65:5:6557]\n[10109.860524] Tainted: [S]=CPU_OUT_OF_SPEC, [O]=OOT_MODULE\n[10109.860524] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 0812 02/24/2023\n[10109.860525] Workqueue: xe_page_fault_work_queue xe_pagefault_queue_work [xe]\n[10109.860644] RIP: 0010:_raw_spin_unlock_irqrestore+0x57/0x80\n[10109.860655] Call Trace:\n[10109.860655] \n[10109.860657] folio_lruvec_lock_irqsave+0x216/0x220\n[10109.860661] ? __pfx_lru_add+0x10/0x10\n[10109.860665] folio_batch_move_lru+0xc8/0x450\n[10109.860670] ? lock_acquire+0xc4/0x2d0\n[10109.860674] ? __folio_batch_add_and_move+0x60/0x2e0\n[10109.860677] ? folio_migrate_mapping+0xa6/0x110\n[10109.860679] ? folio_migrate_flags+0x13b/0x1b0\n[10109.860681] ? __pfx_lru_add+0x10/0x10\n[10109.860683] __folio_batch_add_and_move+0xe7/0x2e0\n[10109.860685] ? dma_iova_try_alloc+0xb0/0x140\n[10109.860689] folio_add_lru+0x64/0x80\n[10109.860691] __migrate_device_finalize+0x12c/0x270\n[10109.860695] migrate_device_finalize+0x10/0x20\n[10109.860698] drm_pagemap_evict_to_ram+0x185/0x370 [drm_gpusvm_helper]\n[10109.860704] ? drm_pagemap_evict_to_ram+0x96/0x370 [drm_gpusvm_helper]\n[10109.860709] xe_svm_bo_evict+0x15/0x20 [xe]\n[10109.860819] ? xe_svm_bo_evict+0x15/0x20 [xe]\n[10109.860921] xe_bo_move+0x107e/0x1570 [xe]\n[10109.860992] ? xe_ttm_tt_create+0x168/0x340 [xe]\n[10109.861059] ? __up_read+0x98/0x2b0\n[10109.861061] ? lock_is_held_type+0xa3/0x130\n[10109.861067] ttm_bo_handle_move_mem+0xe8/0x1e0 [ttm]\n[10109.861075] ttm_bo_evict+0x141/0x1c0 [ttm]\n[10109.861081] ttm_bo_evict_cb+0x9f/0x100 [ttm]\n[10109.861086] ttm_lru_walk_for_evict+0x84/0x190 [ttm]\n[10109.861091] ? xe_ttm_vram_mgr_new+0x258/0x3a0 [xe]\n[10109.861198] ttm_bo_alloc_resource+0x219/0\n---truncated---"}],"id":"CVE-2026-98106","lastModified":"2026-11-12T18:29:18.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-09-25T11:17:41.110","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/62451f540c46bf5c51143a1c8681b472608bd54d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4126f1db36e6b2e1c79b0e30a8a2de91c568f4c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-98107.json b/data/2026/CVE-2026-98107.json index c54b78a422..81f8d97d88 100644 --- a/data/2026/CVE-2026-98107.json +++ b/data/2026/CVE-2026-98107.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fabc5e04f123225daf980d03f2c5a05e7f0f0a7f","status":"affected","version":"da49b602f7f75ccc91386e1274b3ef71676cd092","versionType":"git"},{"lessThan":"ce0927eb3ee2939fab5ce3f9334bfd2fafb38481","status":"affected","version":"da49b602f7f75ccc91386e1274b3ef71676cd092","versionType":"git"},{"lessThan":"6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65","status":"affected","version":"da49b602f7f75ccc91386e1274b3ef71676cd092","versionType":"git"},{"lessThan":"df8c3af6132640da4788e96a02d653e642059803","status":"affected","version":"da49b602f7f75ccc91386e1274b3ef71676cd092","versionType":"git"},{"lessThan":"56c2b5831d39dc84aad2573dc3e197af1a872a05","status":"affected","version":"da49b602f7f75ccc91386e1274b3ef71676cd092","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect\n\nl2cap_chan_connect() tries to ensure there are no more than\nL2CAP_ECRED_CONN_SCID_MAX pending ECRED channels, so they fit in the\nsame L2CAP_ECRED_CONN_REQ that l2cap_ecred_connect() constructs.\n\nHowever, the check only counts deferred channels. If 6 L2CAP sockets\nare connected at the same time in order DDDDND (D=deferred,\nN=non-deferred), the last can bump the total to max+1. It results to\none __le16 written out of bounds of the scid array, and an invalid\nECRED_CONN_REQ being sent.\n\nFix by leaving room for the non-deferred pending ECRED channels in the\ncounting in l2cap_chan_connect(), so the limit can't be exceeded.\n\nMove counting under same critical section where the channel is added.\nAlthough race conditions involving this appear unreachable, it's easier\nto see.\n\nAlso add WARN_ON_ONCE check in l2cap_ecred_defer_connect() to make this\nless brittle."}],"id":"CVE-2026-98107","lastModified":"2026-10-21T13:21:22.877","metrics":{},"published":"2026-09-25T11:17:41.743","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/56c2b5831d39dc84aad2573dc3e197af1a872a05"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ce0927eb3ee2939fab5ce3f9334bfd2fafb38481"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/df8c3af6132640da4788e96a02d653e642059803"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fabc5e04f123225daf980d03f2c5a05e7f0f0a7f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fabc5e04f123225daf980d03f2c5a05e7f0f0a7f","status":"affected","version":"da49b602f7f75ccc91386e1274b3ef71676cd092","versionType":"git"},{"lessThan":"ce0927eb3ee2939fab5ce3f9334bfd2fafb38481","status":"affected","version":"da49b602f7f75ccc91386e1274b3ef71676cd092","versionType":"git"},{"lessThan":"6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65","status":"affected","version":"da49b602f7f75ccc91386e1274b3ef71676cd092","versionType":"git"},{"lessThan":"df8c3af6132640da4788e96a02d653e642059803","status":"affected","version":"da49b602f7f75ccc91386e1274b3ef71676cd092","versionType":"git"},{"lessThan":"56c2b5831d39dc84aad2573dc3e197af1a872a05","status":"affected","version":"da49b602f7f75ccc91386e1274b3ef71676cd092","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8D8F4956-FC0C-4D3B-9FDC-D1F54791B2CF","versionEndExcluding":"6.6.160","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81","versionEndExcluding":"6.12.111","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8","versionEndExcluding":"6.18.53","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921","versionEndExcluding":"7.2.7","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect\n\nl2cap_chan_connect() tries to ensure there are no more than\nL2CAP_ECRED_CONN_SCID_MAX pending ECRED channels, so they fit in the\nsame L2CAP_ECRED_CONN_REQ that l2cap_ecred_connect() constructs.\n\nHowever, the check only counts deferred channels. If 6 L2CAP sockets\nare connected at the same time in order DDDDND (D=deferred,\nN=non-deferred), the last can bump the total to max+1. It results to\none __le16 written out of bounds of the scid array, and an invalid\nECRED_CONN_REQ being sent.\n\nFix by leaving room for the non-deferred pending ECRED channels in the\ncounting in l2cap_chan_connect(), so the limit can't be exceeded.\n\nMove counting under same critical section where the channel is added.\nAlthough race conditions involving this appear unreachable, it's easier\nto see.\n\nAlso add WARN_ON_ONCE check in l2cap_ecred_defer_connect() to make this\nless brittle."}],"id":"CVE-2026-98107","lastModified":"2026-11-12T18:28:34.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-09-25T11:17:41.743","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/56c2b5831d39dc84aad2573dc3e197af1a872a05"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6da5c0331fc3ef0c7b8df8269523fc3b2cce1e65"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ce0927eb3ee2939fab5ce3f9334bfd2fafb38481"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df8c3af6132640da4788e96a02d653e642059803"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fabc5e04f123225daf980d03f2c5a05e7f0f0a7f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-98108.json b/data/2026/CVE-2026-98108.json index cff02e0c91..0e7dc6a18a 100644 --- a/data/2026/CVE-2026-98108.json +++ b/data/2026/CVE-2026-98108.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ad0f44a3f1f688558ed876a0702bc2c82b0df689","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"564ae0e05e598aa895b9dbd18cb7d6eb64752869","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"aab17938998b29e75c3324763411aef3e300fc67","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"1074bcc57f741223f9fa82ce6afe5c3d783e4d10","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"6cb79e6499228cfdbd4b3301371ce74d01cd2f80","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"4ef05db5b08b176a551b4a6287372045998806b0","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.271","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.222","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel. l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode. This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan->mode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle."}],"id":"CVE-2026-98108","lastModified":"2026-10-19T10:18:08.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-09-25T11:17:41.863","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ad0f44a3f1f688558ed876a0702bc2c82b0df689","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"564ae0e05e598aa895b9dbd18cb7d6eb64752869","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"aab17938998b29e75c3324763411aef3e300fc67","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"0e1fc7cab95ad958e55d70a5dfaaea687c9c639f","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"1074bcc57f741223f9fa82ce6afe5c3d783e4d10","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"6cb79e6499228cfdbd4b3301371ce74d01cd2f80","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"4ef05db5b08b176a551b4a6287372045998806b0","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.271","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.222","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E8E167F2-7FB2-4A41-98CC-3DA4B2BC4E16","versionEndExcluding":"5.10.271","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A5EFABC8-89EB-4EE7-9EE1-A9A30E730AFC","versionEndExcluding":"5.15.222","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE14E0F2-AE30-4319-B6E7-5D8B82530FD6","versionEndExcluding":"6.1.189","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0","versionEndExcluding":"6.6.158","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"47BC31C9-3D9E-4B96-B5F8-291D6AD55D81","versionEndExcluding":"6.12.111","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7561AABB-6D5A-4324-BC66-C6C6B012AFD8","versionEndExcluding":"6.18.53","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"19917B2D-B4B2-4416-A482-9C7C4929A921","versionEndExcluding":"7.2.7","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel. l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode. This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan->mode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle."}],"id":"CVE-2026-98108","lastModified":"2026-11-12T18:27:45.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-09-25T11:17:41.863","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e1fc7cab95ad958e55d70a5dfaaea687c9c639f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1074bcc57f741223f9fa82ce6afe5c3d783e4d10"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4ef05db5b08b176a551b4a6287372045998806b0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/564ae0e05e598aa895b9dbd18cb7d6eb64752869"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d5a625cbc854d4c4f68e4b16fcf6e682d9a9ed1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6cb79e6499228cfdbd4b3301371ce74d01cd2f80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aab17938998b29e75c3324763411aef3e300fc67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad0f44a3f1f688558ed876a0702bc2c82b0df689"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-98432.json b/data/2026/CVE-2026-98432.json index 565618802b..afd1101a1c 100644 --- a/data/2026/CVE-2026-98432.json +++ b/data/2026/CVE-2026-98432.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/af_inet.c","net/ipv4/tcp_ipv4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b3b027ef0cd322bfa839b9aaf5b27551eea54cf6","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"95a8c8fa9f27dce64c40c41c062de7728bf34ab5","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"89b5b1eb7d633c33832b7ff2c02e19a144705036","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"742f73df544e03744f2981c467d6542fe8172a2a","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"11a03ce3c4a62d84c10ccdfe47f8075006498568","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"a47406c769f72c070386985488f1c4d057df86b2","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"26d4c36d318cffbbd160884a0e4cec0da4da4936","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"e3f33b0a1d89d738e2b913dab519226eaf76e15b","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/af_inet.c","net/ipv4/tcp_ipv4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.4"},{"lessThan":"4.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.272","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.223","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.190","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.159","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.113","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.56","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the\nchild socket (newinet->inet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt->optlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch."}],"id":"CVE-2026-98432","lastModified":"2026-11-06T19:28:12.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-10-15T13:17:13.987","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/10/30/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/10/30/6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/10/31/5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/03/1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/af_inet.c","net/ipv4/tcp_ipv4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b3b027ef0cd322bfa839b9aaf5b27551eea54cf6","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"95a8c8fa9f27dce64c40c41c062de7728bf34ab5","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"89b5b1eb7d633c33832b7ff2c02e19a144705036","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"742f73df544e03744f2981c467d6542fe8172a2a","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"11a03ce3c4a62d84c10ccdfe47f8075006498568","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"a47406c769f72c070386985488f1c4d057df86b2","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"26d4c36d318cffbbd160884a0e4cec0da4da4936","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"},{"lessThan":"e3f33b0a1d89d738e2b913dab519226eaf76e15b","status":"affected","version":"079096f103faca2dd87342cca6f23d4b34da8871","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/af_inet.c","net/ipv4/tcp_ipv4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.4"},{"lessThan":"4.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.272","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.223","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.190","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.159","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.113","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.56","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"63077796-E917-4D64-927F-4CB73FFB866B","versionEndExcluding":"5.10.272","versionStartIncluding":"4.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"12BB2189-0452-4314-BC42-26B404FF70F2","versionEndExcluding":"5.15.223","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8D2FA3DF-5950-41B6-A12A-F9DAAB475157","versionEndExcluding":"6.1.190","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F0E3723C-074E-45ED-B976-495A2B4D26DD","versionEndExcluding":"6.6.159","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B3198CFF-6B76-48E7-BE5C-E081F4A5370E","versionEndExcluding":"6.12.113","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B460D1F-0A53-4B82-80B3-7CE97689DA5D","versionEndExcluding":"6.18.56","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8F1CB2CB-C508-4DBA-9A50-E536C6951B74","versionEndExcluding":"7.2.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*","matchCriteriaId":"11E35E1B-5DB4-4AB9-9706-CD73B799EADF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc2:*:*:*:*:*:*","matchCriteriaId":"14FD7B9A-4946-4511-8E63-6E13870CD4A8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc3:*:*:*:*:*:*","matchCriteriaId":"F06EDE17-AD0F-4C81-AF8C-D86B6AF0F622","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc4:*:*:*:*:*:*","matchCriteriaId":"F8228CD7-8FCE-4203-A2D9-42CD195ACB2A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc5:*:*:*:*:*:*","matchCriteriaId":"FAA5DD31-A3A0-414D-8D78-7C36F75EF1E7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.3:rc6:*:*:*:*:*:*","matchCriteriaId":"9526555A-60FB-4653-9B37-ECC43CA6D79D","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the\nchild socket (newinet->inet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt->optlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch."}],"id":"CVE-2026-98432","lastModified":"2026-11-12T18:23:34.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-10-15T13:17:13.987","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/10/30/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/10/30/6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/10/31/5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/11/03/1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/state/sync.json b/state/sync.json index 0ae3567f65..0008b5e432 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1 +1 @@ -{"initial_complete":true,"last_run_counts":{"seen":6331,"skipped":39,"unchanged":5766,"written":526},"last_run_mode":"incremental","last_successful_end":"2026-11-12T16:42:30+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-12T16:48:08.452772+00:00"} +{"initial_complete":true,"last_run_counts":{"seen":6582,"skipped":39,"unchanged":4864,"written":1679},"last_run_mode":"incremental","last_successful_end":"2026-11-12T20:42:26+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-12T20:47:36.515969+00:00"}